Is Intrusion Detection System Research Articles

Detecting Denial of Service Attacks (DoS) over the Internet of Drones (IoD) Based on Machine Learning

The use of Unmanned Aerial Vehicles (UAVs) or drones has increased lately. This phenomenon is due to UAVs’ wide range of applications in fields such as agriculture, delivery, security and surveillance, and construction. In this context, the security and the continuity of UAV operations becomes a crucial issue. Spoofing, jamming, hijacking, and Denial of Service (DoS) attacks are just a few categories of attacks that threaten drones. The present paper is focused on the security of UAVs against DoS attacks. It illustrates the pros and cons of existing methods and resulting challenges. From here, we develop a novel method to detect DoS attacks in UAV environments. DoS attacks themselves have many sub-categories and can be executed using many techniques. Consequently, there is a need for robust protection and mitigation systems to shield UAVs from DoS attacks. One promising security solution is intrusion detection systems (IDSs). IDs paired with machine learning (ML) techniques provide the ability to greatly reduce the risk, as attacks can be detected before they happen. ML plays an important part in improving the performance of IDSs. The many existing ML models that detect DoS attacks on UAVs each carry their own strengths and limitations.

Hybrid Model-Based Intrusion Detection in Wireless Sensor Network on the Basis of Risk and Link Quality

Nowadays, Wireless Sensor Networks (WSN) face more security threats due to the increased service of data transmission at high speed in almost all applications. The security of the network must be ensured by identifying abnormal traffic and current emerging threats. The most promising model for safeguarding the core network from outside attacks is Intrusion Detection Systems (IDS). This work focuses on the introduction of clustering-based intrusion detection in WSN. Initially, clustering takes place, where the nodes are grouped under certain constraints via selecting the optimal Cluster Head (CH). The considered constraints are energy, delay, distance, risk, and link quality. This optimal selection takes place by a new hybrid optimization algorithm termed as Truncate Combined Bald Eagle Optimization (TCBEO) algorithm. The subsequent process is intrusion detection, where a hybrid detection model combining a Convolutional Neural Network (CNN) & Bi-directional Gated Recurrent unit (Bi-GRU) is employed, which is trained with features like improved entropy and correlation taking into consideration of constraints like energy and distance, respectively. Eventually, the suggested work’s effectiveness is affirmed against existing techniques using various performance metrics.

Improving IoT Security using Lightweight Based Deep Learning Protection Model

The Internet of Things (IoT) has recently become an essential ingredient of human life. The main critical challenges that confront IoT are security and protection. Several methods have been developed to protect the IoT; among these methods is Intrusion Detection System (IDS) Deep Learning-based. On the other hand, these types of IDS have a complex operation that takes a long time when applied on IoT devices and is inconvenient for a massive system that includes many connected devices. Thus, this paper suggested a Lightweight Intrusion Detection System (LIDS) IoT model that depends on deep learning using a Multi-Layer Perceptron (MLP) network. LIDS has the following characteristics lightweight, high accuracy, high speed in detection, and deals with a few features in MQTT protocol. The MQTTset dataset was used in training, validating, and testing the proposed model to investigate the performance of the proposed LIDS. The achieved performance ratios for the proposed LIDS, as measured by accuracy and F1-score. The experiment results showed that for the balanced MQTTset dataset, the number of obtained features was 15 with accuracy (95.06) and F1_score (95.31). Also, for the imbalanced MQTTset, the number of obtained features was 12 with accuracy (96.97) and F1-score (98.24). The obtained results have shown the deep learning efficiency role in improving the accuracy of an intrusion detection model by approximately 3.5% compared to other methods in the literature. In addition, the proposed methods reduced the number of features by around 50% of the total number of features, leading to a LIDS operating in a constrained environment.

Intruder Detection in VANET Data Streams Using Federated Learning for Smart City Environments

Vehicular networks improve quality of life, security, and safety, making them crucial to smart city development. With the rapid advancement of intelligent vehicles, the confidentiality and security concerns surrounding vehicular ad hoc networks (VANETs) have garnered considerable attention. VANETs are intrinsically more vulnerable to attacks than wired networks due to high mobility, common network medium, and lack of centrally managed security services. Intrusion detection (ID) servers are the first protection layer against cyberattacks in this digital age. The most frequently used mechanism in a VANET is intrusion detection systems (IDSs), which rely on vehicle collaboration to identify attackers. Regrettably, existing cooperative IDSs get corrupted and cause the IDSs to operate abnormally. This article presents an approach to intrusion detection based on the distributed federated learning (FL) of heterogeneous neural networks for smart cities. It saves time and resources by using the most efficient intruder detection approach. First, vehicles use a federated learning technique to develop local, deep learning-based IDS classifiers for VANET data streams. They then share their locally learned classifiers upon request, significantly reducing communication overhead with neighboring vehicles. Then, an ensemble of federated heterogeneous neural networks is constructed for each vehicle, including locally and remotely trained classifiers. Finally, the global ensemble model is again shared with local devices for their updating. The effectiveness of the suggested method for intrusion detection in VANETs is evaluated using performance indicators such as attack detection rates, classification accuracy, precision, recall, and F1 scores over a ToN-IoT data stream. The ID model shows 0.994 training and 0.981 testing accuracy.

Hybrid Feature Selection Method for Intrusion Detection Systems Based on an Improved Intelligent Water Drop Algorithm

AbstractA critical task and a competitive research area is to secure networks against attacks. One of the most popular security solutions is Intrusion Detection Systems (IDS). Machine learning has been recently used by researchers to develop high performance IDS. One of the main challenges in developing intelligent IDS is Feature Selection (FS). In this manuscript, a hybrid FS for the IDS network is proposed based on an ensemble filter, and an improved Intelligent Water Drop (IWD) wrapper. The Improved version from IWD algorithm uses local search algorithm as an extra operator to increase the exploiting capability of the basic IWD algorithm. Experimental results on three benchmark datasets “UNSW-NB15”, “NLS-KDD”, and “KDDCUPP99” demonstrate the effectiveness of the proposed model for IDS versus some of the most recent IDS algorithms existing in the literature depending on “F-score”, “accuracy”, “FPR”, “TPR” and “the number of selected features” metrics.

CloudIDS: Cloud Intrusion Detection Model Inspired by Dendritic Cell Mechanism

Cloud Computing Security is a new era of computer technology and opens a new research area and creates a lot of opportunity of exploration. One of the new implementation in Cloud is Intrusion Detection System (IDS).There are problems with existing IDS approach in Cloud environment. Implementing traditional IDS need a lot of self-maintenance and did not scale with the customer security requirements. In addition, maintenance of traditional IDS in Cloud Computing system requires expertise and consumes more time where not each Cloud user has. A decentralized traditional IDS approach where being deployed in current Cloud Computing infrastructure will make the IDS management become complicated. Each user's IDS will not be the same in term of type and configurations and each user may have outdated signatures. Inter VM's communication also become a big concern when we implementing Cloud Computing system where communication between Clouds are not monitored and controlled by the traditional IDS. A specific IDS model for Cloud computing is required to solve these problems. In this paper, we develop a prototype of Cloud IDS inspired by Dendritic Cell mechanism. Experiment result proved that Cloud IDS was able to detect any attempt to attack the Cloud environment. The experiments show that the Cloud IDS model based on Dendritic Cell algorithm able to identify and detect novel threat that targeting Cloud environment.

An enhanced classification framework for intrusions detection system using intelligent exoplanet atmospheric retrieval algorithm

Currently, many companies use data mining for various implementations. One form of implementation is intrusion detection system (IDS). In IDS, the main problem for nuisance network administrators in detecting attacks is false alerts. Regardless of the methods implemented by this system, eliminating false alerts is still a huge problem. To describe data traffic passing through the network, a database of the network security layer (NSL) knowledge discovery in database (KDD) dataset is used. The massive traffic of data sent over the network contains excessive and duplicated amounts of information. This causes the classifier to be biased, reduce classification accuracy, and increase false alert. To that end, we proposed a model that significantly improve the accuracy of the intrusion detection system by eliminating false alerts, whether they are false negative or false positive negative alerts. The results show that the proposed intelligent exoplanet atmospheric retrieval (INARA) algorithm has improved accuracy and is able to detect new attack types efficiently.

Performance Evaluation of Classification Algorithms for Intrusion Detection on NSL-KDD Using Rapid Miner

The rapid advancement of the internet and its exponentially increasing usage has also exposed it to several vulnerabilities. Consequently, it has become an extremely important that can prevent network security issues. One of the most commonly implemented solutions is Intrusion Detection System (IDS) that can detect unusual attacks and unauthorized access to a secured network. In the past, several machine learning algorithms have been evaluated on the KDD intrusion dataset. However, this paper focuses on the implementation of the four machine learning algorithms: KNN, Random Forest, gradient boosted tree and decision tree. The models are also implemented through the Auto Model feature to determine its convenience. The results show that Gradient Boosted trees have achieved the highest accuracy (99.42%) in comparison to random forest algorithm that achieved the lowest accuracy (93.63%).

Using Incremental Ensemble Learning Techniques to Design Portable Intrusion Detection for Computationally Constraint Systems

Computers have evolved over the years, and as the evolution continues, we have been ushered into an era where high-speed internet has made it possible for devices in our homes, hospital, energy, and industry to communicate with each other. This era is known as the Internet of Things (IoT). IoT has several benefits in a country’s economy’s health, energy, transportation, and agriculture sectors. These enormous benefits, coupled with the computational constraint of IoT devices, make it challenging to deploy enhanced security protocols on them, making IoT devices a target of cyber-attacks. One approach that has been used in traditional computing over the years to fight cyber-attacks is Intrusion Detection System (IDS). However, it is practically impossible to deploy IDS meant for traditional computers in IoT environments because of the computational constraint of these devices. This study proposes a lightweight IDS for IoT devices using an incremental ensemble learning technique. We used Gaussian Naive Bayes and Hoeffding trees to build our incremental ensemble model. The model was then evaluated on the TON IoT dataset. Our proposed model was compared with other proposed state-of-the-art methods and evaluated using the same dataset. The experimental results show that the proposed model achieved an average accuracy of 99.98%. We also evaluated the memory consumption of our model, which showed that our model achieved a lightweight model status of 650.11KB as the highest memory consumption and 122.38KB as the lowest memory consumption.

Detection of Black Hole Attack Using Honeypot Agent-Based Scheme with Deep Learning Technique on MANET

Mobile Ad-Hoc Networks (MANETs) due to their reconfigurable nature are being integrated into new and futuristic knowledge such as Internet of Things (IoT), cloud, reconfigurable networks, etc. To attain such credibility of integration, the routing protocols associated with these mobile nodes have to connect, perform and facilitate routing that offers a high level of security and resistance to all possible threats and security issues that may emanate in the network. One of the solutions used to maintain network security is intrusion detection systems (IDSs). This article primarily emphasis on the network's susceptibility to a suction assault known as a black hole attack. The investigations about the employment of intelligent agents called Honeypot Agent-based detection scheme (HPAS) with Long-Short Term Memory (LSTM) in identifying such assaults. Hence, the proposed method is named HPAS-LSTM, where honeypots are roaming virtual software managers that create Route Request (RREQ) packets to attract and entrap black hole attackers. Extensive model results utilizing the ns-2 simulator are used to demonstrate the presence of the suggested detection technique. The simulation outcomes demonstrate that the suggested technique outperforms current black hole detection methods in terms of throughput (TH), packet loss rate (PLR), packet delivery ratio (PDR), and total network delay (TND).

Featureless Discovery of Correlated and False Intrusion Alerts

Malware and cyber-attacks cause substantial damage to corporations. A common countermeasure is Intrusion Detection Systems (IDSs). Unfortunately, IDSs typically raise many alerts on a single incident, with redundant information, and false alerts that are only noise to analysts. For out-of-the-box performance, the impact is so large that alerts are of limited practical use. Existing solutions rely heavily on domain expertise, in feature engineering procedures and explicit algorithms. This has substantial negative impact on the costs of development, deployment, and maintenance. Using feature engineering as part of a method boosts classification metrics, but requires substantial investment, of data science and security expertise, for each deployment. We find that reliance on domain expertise and feature engineering severely inhibits the feasibility of applying existing correlation and filtering methods in practice. To address this, we propose a novel approach for correlating and filtering, with the constraints that methods must be without feature engineering and methods must consume alerts as text strings. Two implementations are presented and evaluated on a partly private and on a public data set. Our implementations are unable to compete with existing methods on common detection metrics, suggesting that investing feature engineering pays of towards those. Measured on practical metrics for filtering and correlating, our implementations are promising, while at the same time cutting the cost of deployment, according to the constraints. Consequently, we find it of practical relevance to consider methods, like ours, that are much easier and cheaper to deploy, compared to the existing ones.

Anomaly-based intrusion detection system using multi-objective grey wolf optimisation algorithm

The rapid development of information technology leads to increasing the number of devices connected to the Internet. Besides, the amount of network attacks also increased. Accordingly, there is an urgent demand to design a defence system proficient in discovering new kinds of attacks. One of the most effective protection systems is intrusion detection system (IDS). The IDS is an intelligent system that monitors and inspects the network packets to identify the abnormal behavior. In addition, the network packets comprise many attributes and there are many attributes that are irrelevant and repetitive which degrade the performance of the IDS system and overwhelm the system resources. A feature selection technique helps to reduce the computation time and complexity by selecting the optimum subset of features. In this paper, an enhanced anomaly-based IDS model based on multi-objective grey wolf optimisation (GWO) algorithm was proposed. The GWO algorithm was employed as a feature selection mechanism to identify the most relevant features from the dataset that contribute to high classification accuracy. Furthermore, support vector machine was used to estimate the capability of selected features in predicting the attacks accurately. Moreover, 20% of NSL–KDD dataset was used to demonstrate effectiveness of the proposed approach through different attack scenarios. The experimental result revealed that the proposed approach obtains classification accuracy of (93.64%, 91.01%, 57.72%, 53.7%) for DoS, Probe, R2L, and U2R attack respectively. Finally, the proposed approach was compared with other existing approaches and achieves significant result.

Improve Accuracy of Intrusion Detection System Using the Synthesis Computing Classifier Methodology

 Abstract—Network security is the most critical part in organizations, social and enterprise systems. There are different levels in security. (The first level being preventions) The Most important level is Intrusion Detection System (IDS). IDS's are responsible for monitoring security issues, network traffic etc., But it's most essential task is detection of intrusions. Computing classifiers play a major role in all research areas including IDS. IDS have been achieved following different procedures and methods which have been projected in various research works. But, many of them aren't able to compute the problem with full accuracy assessment. So, main objective of my research work is to integrate numerous computing techniques into a categorized system, to detect and classify intrusions from usual activities based on the attack type in a computer network and try to improve the accuracy assessment. One of the most used mechanisms for creating rule sets is Decision-tree approach. Decision tree creations, using numerous algorithms, have been produced by different people. So far, the best algorithm is a C4.5/SEE 5.0. Using this algorithm constructs rule set 1. More than this a prominent approach to create rules other hand soft computing methods is Neural Network Theory and Fuzzy Logic. The next step, to create rule set 2, using both approaches are amalgamate and allocate. Final rule set derivation, in a process called Synthesis Computing Classifiers, can be done using Build decision boundary methodology based on the above rule set1 and set 2. The investigational result sets clearly show that the proposed new systems have achieved higher precision in identifying whether the records are normal or attack one.

A Comprehensive Survey on Anomaly-Based Intrusion Detection in MANET

In recent years, mobile ad hoc networks (MANET) have become an interesting research area. This type of networks have a salient characteristics compare with wired networks which are more vulnerable. Nowadays, for the network security, defend in depth strategies are used. One of them is intrusion detection system (IDS). Many intrusion detection techniques developed for weird networks however, because the nature of MANET we cannot apply them directly in MANET. According to detection techniques, IDSs can be classified into three categories as follows: Misuse-based detection, Anomaly-based detection, and Specification-based detection. In this paper, we are going to evaluate anomaly-based intrusion detection techniques proposed for MANET. For this, we present a comprehensive survey about anomaly based intrusion detection techniques. Afterward we evaluate their performance, advantages, and disadvantages. As a result constantly, we will understand MANET’s security problems based on which we can suggest solutions for future research.

Intrusion Detection System using Bayesian Network and Hidden Markov Model

Across the globe, billions of dollars are spending every year to provide security to the network systems to prevent the intrusions. Some consider the disruption of the vital systems as a serious threat which disables the work of hospitals, banks, military and various internet services across the world. To avert this impending threat, there are many possible solutions: one of these solutions is intrusion detection systems (IDS). The paper proposes to discuss the IDS model in its elaboration using Bayesian Network and the Hidden Markov Model (HMM) approach with KDDCUP dataset. The IDS framework has been designed with various levels of processing such as model learning with training data and constructing the Bayesian Network and this structure has been used as HMM state transition diagram. The preprocessed KDDCUP dataset has been used to train and test the model. The IDS model has been trained and tested for normal and attack type connection records separately. The results evince that the performance of the model is of high order for classification of normal and intrusions attacks.