Learning Based Intrusion Detection System Research Articles

A novel framework for analyzing internet of things datasets for machine learning and deep learning-based intrusion detection systems

To generate a machine learning (ML) and deep learning (DL) architecture with good performance, we need a decent dataset for the training and testing phases of the development process. Starting with the knowledge discovery and data mining (KDD) Cup 99 dataset, numerous datasets have been produced since 1998 to be utilized in the ML and DL-based intrusion detection systems (IDS) training and testing process. Because there are so many datasets accessible, it might be challenging for researchers to choose which dataset to employ. Therefore, a framework for evaluating dataset appropriateness with the research to be conducted is becoming increasingly crucial as new datasets are regularly created. Additionally, given the growing popularity of internet of things (IoT) devices and an increasing number of specific datasets for IoT in recent years, it is essential to have a specific framework for IoT datasets. Therefore, this research aims to develop a new framework for evaluating IoT datasets for ML and DL-based IDS. The study's findings include, first, a novel framework for assessing IoT datasets, second, a comparison of this novel framework to other existing frameworks, and third, an analysis of five IoT datasets by using the new framework.

ROSPaCe: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System and IoT Networks

Most of the intrusion detection datasets to research machine learning-based intrusion detection systems (IDSs) are devoted to cyber-only systems, and they typically collect data from one architectural layer. Often the attacks are generated in dedicated attack sessions, without reproducing the realistic alternation and overlap of normal and attack actions. We present a dataset for intrusion detection by performing penetration testing on an embedded cyber-physical system built over Robot Operating System 2 (ROS2). Features are monitored from three architectural layers: the Linux operating system, the network, and the ROS2 services. The dataset is structured as a time series and describes the expected behavior of the system and its response to ROS2-specific attacks: it repeatedly alternates periods of attack-free operation with periods when a specific attack is being performed. This allows measuring the time to detect an attacker and the number of malicious activities performed before detection. Also, it allows training an intrusion detector to minimize both, by taking advantage of the numerous alternating periods of normal and attack operations.

Multi-stage deep learning-based intrusion detection system for automotive ethernet networks

Modern automobiles are increasing the demand for automotive Ethernet as a high-bandwidth and flexible in-vehicle network technology. However, since Ethernet does not have native support for authentication or encryption, intrusion detection systems (IDSs) are becoming an attractive security mechanism to detect malicious activities that may affect Ethernet-based communication in cars. This paper proposes a novel multi-stage deep learning-based intrusion detection system to detect and classify cyberattacks in automotive Ethernet networks. The first stage uses a Random Forest classifier to detect cyberattacks quickly. The second stage, on the other hand, uses a Pruned Convolutional Neural Network that minimizes false positive rates while classifying different types of cyberattacks. We evaluate our proposed IDS using two publicly available automotive Ethernet intrusion datasets. The experimental results show that our proposed solution detects cyberattacks with a similar detection rate and a faster detection time compared to other state-of-the-art baseline automotive Ethernet IDSs.

A federated learning-based zero trust intrusion detection system for Internet of Things

The exponential growth of Internet of Things (IoT) devices poses distinctive challenges to safeguarding the security and privacy of interconnected systems. As the frequency of cyberattacks continues to escalate, the development of an effective and scalable Intrusion Detection System (IDS) based on Federated Learning (FL) for IoT becomes increasingly complex. Existing methodologies struggle to balance spatial and temporal feature extraction, particularly when confronted with dynamic and evolving cyber threats. Additionally, the lack of diversity in datasets employed for FL-based IDS evaluations further hinders progress. Furthermore, a notable tradeoff between performance and scalability emerges, particularly as the number of edge devices in communication grows. Motivated by the aforementioned challenges, this article presents a horizontal FL model that combines Convolutional Neural Networks (CNN) and Bidirectional Long-Term Short Memory (BiLSTM) for effective intrusion detection. This hybrid approach aims to address the limitations of existing methods and enhance the effectiveness of intrusion detection in the context of FL for IoT. Specifically, CNN plays a pivotal role in spatial feature extraction, allowing the model to identify and comprehend local patterns indicative of potential intrusions, and the BiLSTM component contributes by capturing temporal dependencies and learning sequential patterns within the data. The proposed IDS adheres to a zero-trust model by keeping the data on local edge devices, sharing only the learned weights with the centralized FL server. In turn, the FL server aggregates updates from diverse sources to optimize the accuracy of the global learning model. The experimental results using CICIDS2017 and Edge-IIoTset prove the effectiveness of the proposed approach over centralized and federated deep learning-based IDS.

DRL-GAN: A Hybrid Approach for Binary and Multiclass Network Intrusion Detection.

Our increasingly connected world continues to face an ever-growing number of network-based attacks. An Intrusion Detection System (IDS) is an essential security technology used for detecting these attacks. Although numerous Machine Learning-based IDSs have been proposed for the detection of malicious network traffic, the majority have difficulty properly detecting and classifying the more uncommon attack types. In this paper, we implement a novel hybrid technique using synthetic data produced by a Generative Adversarial Network (GAN) to use as input for training a Deep Reinforcement Learning (DRL) model. Our GAN model is trained on the NSL-KDD dataset, a publicly available collection of labeled network traffic data specifically designed to support the evaluation and benchmarking of IDSs. Ultimately, our findings demonstrate that training the DRL model on synthetic datasets generated by specific GAN models can result in better performance in correctly classifying minority classes over training on the true imbalanced dataset.

Secure deep learning-based energy efficient routing with intrusion detection system for wireless sensor networks

In general, wireless sensor networks are used in various industries, including environmental monitoring, military applications, and queue tracking. To support vital applications, it is crucial to ensure effectiveness and security. To prolong the network lifetime, most current works either introduce energy-preserving and dynamic clustering strategies to maintain the optimal energy level or attempt to address intrusion detection to fix attacks. In addition, some strategies use routing algorithms to secure the network from one or two attacks to meet this requirement, but many fewer solutions can withstand multiple types of attacks. So, this paper proposes a secure deep learning-based energy-efficient routing (SDLEER) mechanism for WSNs that comes with an intrusion detection system for detecting attacks in the network. The proposed system overcomes the existing solutions’ drawbacks by including energy-efficient intrusion detection and prevention mechanisms in a single network. The system transfers the network’s data in an energy-aware manner and detects various kinds of network attacks in WSNs. The proposed system mainly comprises two phases, such as optimal cluster-based energy-aware routing and deep learning-based intrusion detection system. Initially, the cluster of sensor nodes is formed using the density peak k-mean clustering algorithm. After that, the proposed system applies an improved pelican optimization approach to select the cluster heads optimally. The data are transmitted to the base station via the chosen optimal cluster heads. Next, in the attack detection phase, the preprocessing operations, such as missing value imputation and normalization, are done on the gathered dataset. Next, the proposed system applies principal component analysis to reduce the dimensionality of the dataset. Finally, intrusion classification is performed by Smish activation included recurrent neural networks. The proposed system uses the NSL-KDD dataset to train and test it. The proposed one consumes a minimum energy of 49.67 mJ, achieves a better delivery rate of 99.92%, takes less lifetime of 5902 rounds, 0.057 s delay, and achieves a higher throughput of 0.99 Mbps when considering a maximum of 500 nodes in the network. Also, the proposed one achieves 99.76% accuracy for the intrusion detection. Thus, the simulation outcomes prove the superiority of the proposed SDLEER system over the existing schemes for routing and attack detection.

Blockchain Assisted Fireworks Optimization with Machine Learning based Intrusion Detection System (IDS)

Blockchain Assisted Fireworks Optimization with Machine Learning based Intrusion Detection System (IDS)

Empirical Enhancement of Intrusion Detection Systems: A Comprehensive Approach with Genetic Algorithm-based Hyperparameter Tuning and Hybrid Feature Selection

AbstractMachine learning-based IDSs have demonstrated promising outcomes in identifying and mitigating security threats within IoT networks. However, the efficacy of such systems is contingent on various hyperparameters, necessitating optimization to elevate their performance. This paper introduces a comprehensive empirical and quantitative exploration aimed at enhancing intrusion detection systems (IDSs). The study capitalizes on a genetic algorithm-based hyperparameter tuning mechanism and a pioneering hybrid feature selection approach to systematically investigate incremental performance improvements in IDS. Specifically, our work proposes a machine learning-based IDS approach tailored for detecting attacks in IoT environments. To achieve this, we introduce a hybrid feature selection method designed to identify the most salient features for the task. Additionally, we employed the genetic algorithm (GA) to fine-tune hyperparameters of multiple machine learning models, ensuring their accuracy in detecting attacks. We commence by evaluating the default hyperparameters of these models on the CICIDS2017 dataset, followed by rigorous testing of the same algorithms post-optimization through GA. Through a series of experiments, we scrutinize the impact of combining feature selection methods with hyperparameter tuning approaches. The outcomes unequivocally demonstrate the potential of hyperparameter optimization in enhancing the accuracy and efficiency of machine learning-based IDS systems for IoT networks. The empirical nature of our research method provides a meticulous analysis of the efficacy of the proposed techniques through systematic experimentation and quantitative evaluation. Consolidated in a unified manner, the results underscore the step-by-step enhancement of IDS performance, especially in terms of detection time, substantiating the efficacy of our approach in real-world scenarios.

A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system

A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system

An end-to-end learning approach for enhancing intrusion detection in Industrial-Internet of Things

The Industrial-Internet of Things (I-IoT) stands out as one of the most dynamically evolving subfields within the expansive realm of the Internet of Things (IoT). Its exponential growth is reshaping industrial landscapes, bringing forth transformative innovations and advancements at an unprecedented pace, as the core of Industry 4.0. Among the formidable challenges faced by the Industrial-Internet of Things, cybersecurity stands out as a critical concern. Deep learning-based Intrusion Detection System (IDS) solutions showcase their steadfast ability to secure resource-limited, investigation-demanding, and complex I-IoT environments. However, their effectiveness hinges not only on the model but also on the dataset on which they are trained. While numerous literature studies delve into this field, existing proposed models often grapple with challenges. They are frequently trained on outdated, non-diverse datasets or lack specific features crucial for I-IoT networks. Recent efforts, thankfully, introduce more adequate datasets like Edge-IIoTset. Researchers leverage this extensive dataset to train models, focusing on detecting the 14 sophisticated attacks. These attacks predominantly target real I-IoT networks. Despite these efforts, none of the existing models proves entirely efficient. A review of literature solutions reveals that many models cannot detect all 15 classes in the dataset. Some are multi-staged or overly complex. In response to these challenges, this paper presents an End-to-End learning , non-complex CNN1D model tailored to the specific problem of detecting 14 sophisticated threats targeting I-IoT environments. Our proposed model demonstrated remarkable efficiency with an accuracy of 99.96%, successfully detecting all 15 classes in the Edge-IIoTset dataset with a minimal loss of 0.0011. Not only that, but our model was validated with k-fold cross-validation, demonstrating its efficiency in preserving the same performance on unseen data and its ability to be generalized for real-world I-IoT environments.

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

The cyber-physical system (CPS) plays a crucial role in supporting critical infrastructure like water treatment facilities, gas stations, air conditioning components, and smart grids, which are essential to society. However, these systems are facing a growing susceptibility to a wide range of emerging attacks. Cyber-attacks against CPS have the potential to cause disruptions in the accurate sensing and actuation processes, resulting in significant harm to physical entities and posing concerns for the overall safety of society. Unlike common security measures like firewalls and encryption, which often aren't enough to deal with the unique problems that CPS architectures present, deploying machine learning-based intrusion detection systems (IDS) that are specifically made for CPS has become an important way to make them safer. The application of machine learning algorithms has been suggested as a means of mitigating cyber-attacks on CPS. However, the limited availability of labelled data pertaining to emerging attack techniques poses a significant challenge to the accurate detection of such attacks. In the given scenario, transfer learning emerges as a promising methodology for the detection of cyber-attacks, as it involves the implicit modelling of the system. In this research, we propose a new lightweight transfer learning method via ResNet50-CNN1D for intrusion detection in CPS. The Adaptive Gradient (Adagrad) optimizer was applied in the proposed model to minimize the loss function through the adjustment of network weight. We tested how well the suggested ResNet50-1D-CNN model worked using the UNSW-NB15 dataset and a control system dataset called HAI. The HAI dataset was taken from the testbed and based on a planned physical attack scenario. By calculating the coefficient scores for the top ten (10) features in the HAI and UNSW-NB15 data, it was possible to determine the relevance of a feature. The rationale behind employing transfer learning was to mitigate the complexity associated with the classification of cyber-attacks and runtime. The utilization of transfer learning resulted in notable reductions in both the training and testing times required for the detection of attacks. On the HAI data, the results showed an accuracy of 97.32 %, recall of 98.41 %, F1-score of 96.32 %, and precision of 97.09 %. On the UNSW-NB15 data, the results showed an accuracy of 99.89 %, recall of 99.09 %, F1-score of 98.01 %, and precision of 98.70 %.

A review on machine learning based intrusion detection system for internet of things enabled environment

Within an internet of things (IoT) environment, the fundamental purpose of various devices is to gather the abundant amount of data that is being generated and then transmit this data to the predetermined server over the internet. IoT connects billions of objects and the internet to communicate without human intervention. But network security and privacy issues are increasing very fast, in today's world. Because of the prevalence of technological advancement in regular activities, internet security has evolved into a necessary requirement. Because technology is integrated into every aspect of contemporary life, cyberattacks on the internet of things represent a bigger danger than attacks against traditional networks. Researchers have found that combining machine learning techniques into an intrusion detection system (IDS) is an efficient way to get beyond the limitations of conventional IDSs in an IoT context. This research presents a comprehensive literature assessment and develops an intrusion detection system that makes use of machine learning techniques to address security problems in an IoT environment. Along with a comprehensive look at the state of the art in terms of intrusion detection systems for IoT-enabled environments, this study also examines the attributes of approaches, common datasets, and existing methods utilized to construct such systems.

Strengthening Wireless Network Security: Supervised Machine Learning-Based Intrusion Detection for Enhanced Threat Mitigation

With the wireless networks deemed vital to our laced and unetched world, it has become fundamental to safeguard these networks against the various cyber threats that are on the rise. As a research proposal I show concern about the application of a Supervised Machine Learning-Based Intrusion Detection system, making use of Multilayer Perceptron (MLP), Support Vector Machine (SVM), and Logistic Regression (LR) algorithms. The survey begins with the introduction of an intrusive inter-dataset technology that merges two catalytic datasets into a single efficient model that can address both model security and data sensitivity concerns. The evaluation of several machine learning algorithms within the proposed framework is a core component of the analysis. The accuracy measure as well as others such as recall, precision, and F1 score, are applied to evaluate the algorithms' level in detecting intrusions from different datasets.The investigation shows that the intra-dataset routing noticeably improves the detecting modules' efficiency. Notably, the model of MLP algorithm has enhanced recall which in turn shows the enhancement of the positive instance identification. SVM shows increased precision, which accounts for the improved accuracy since correct names of positive cases are produced more often. LR finds it overall enhance the precisions thus attesting to its efficiency in correct deductions. The research documents the multifaceted nature of IDS, prompting the intervention of the machine learning algorithms with ddoswdelcome intrusion detection system. A study which provides a practical guide for network administrators and security professionals hinting on how to select algorithms to meet the distinct security needs in their enterprises. These findings contribute to the open discourse on wireless network security and serve as a base for future study of this engaging research topic in constantly developing field of intrusion detection.

An Efficient Deep Learningbased Intrusion Detection System for Internet of Things Networks with Hybrid Feature Reduction and Data Balancing Techniques

With the increasing use of Internet of Things (IoT) technologies, cyber-attacks on IoT devices are also increasing day by day. Detecting attacks on IoT networks before they cause any damage is crucial for ensuring the security of the devices on these networks. In this study, a novel Intrusion Detection System (IDS) was developed for IoT networks. The IoTID20 and BoT-IoT datasets were utilized during the training phase and performance testing of the proposed IDS. A hybrid method combining the Principal Component Analysis (PCA) and the Bat Optimization (BAT) algorithm was proposed for dimensionality reduction on the datasets. The Synthetic Minority Over-SamplingTechnique (SMOTE) was used to address the problem of data imbalance in the classes of the datasets. The Convolutional Neural Networks (CNN) model, a deep learning method, was employed for attack classification. The proposed IDS achieved an accuracy rate of 99.97% for the IoTID20 dataset and 99.98% for the BoT-IoT dataset in attack classification. Furthermore, detailed analyses were conducted to determine the effects of the dimensionality reduction and data balancing models on the classification performance of the proposed IDS.

Optimizing deep learning-based intrusion detection in cloud computing environment with chaotic tunicate swarm algorithm

Intrusion Detection (ID) in cloud environments is vital to maintain the safety and integrity of data and resources. However, the presence of class imbalance, where normal samples significantly outweigh intrusive instances, poses a challenge in constructing a potential ID system. Deep Learning (DL) methods, with their capability to automatically study complex patterns and features, present a promising solution in various ID tasks. Such methods can automatically learn intricate features and patterns from the input dataset, making them suitable for detecting anomalies and finding intrusions in cloud environments. Therefore, this study proposes a Class Imbalance Data Handling with an Optimal Deep Learning-Based Intrusion Detection System (CIDH-ODLIDS) in a cloud computing atmosphere. The CIDH-ODLIDS technique leverages optimal DL-based classification and addresses class imbalance. Primarily, the CIDH-ODLIDS technique preprocesses the input data using a Z-score normalization approach to ensure data quality and consistency. To handle class imbalance, the CIDH-ODLIDS technique employs oversampling techniques, particularly focused on synthetic minority oversampling techniques such as Adaptive Synthetic (ADASYN) sampling. ADASYN generates synthetic instances for the minority class depending on the available data instances, effectively balancing the class distribution and mitigating the impact of class imbalance. For the ID process, the CIDH-ODLIDS technique utilizes a Fuzzy Deep Neural Network (FDNN) model, and its tuning procedure is performed using the Chaotic Tunicate Swarm Algorithm (CTSA). CTSA is employed to choose the learning rate of the FDNN methods optimally. The experimental assessment of the CIDH-ODLIDS method is extensively conducted on three IDS datasets. The comprehensive comparison results confirm the superiority of the CIDH-ODLIDS algorithm over existing techniques.

A Review of Machine Learning-based Intrusion Detection System

Intrusion detection systems are mainly prevalent proclivity within our culture today. Interference exposure systems function as countermeasures to identify web-based protection threats. This is a computer or software program that monitors unauthorized network activity and sends alerts to administrators. Intrusion detection systems scan for known threat signatures and anomalies in normal behaviour. This article also analyzed different types of infringement finding systems and modus operandi, focusing on support-vector-machines; Machine-learning; fuzzy-logic; and supervised-learning. For the KDD dataset, we compared different strategies based on their accuracy. Authors pointed out that using support vector machine and machine learning together improves accuracy.

An Intrusion System for Internet of Things Security Breaches Using Machine Learning Techniques

Effective identification and categorization of network attacks are paramount for ensuring robust security. However, contemporary techniques often struggle to accurately discern and classify novel attack patterns. This research introduces an innovative framework designed to achieve reliable attack detection and classification by harnessing the synergistic capabilities of utilizing DenseNet convolutional neural networks and rap music analysis techniques. Our approach leverages feature extraction through the Attention Pyramid Network (RAPNet) framework, tailored to extract pertinent features from input data, alongside binary Pigeon optimization. Subsequently, we employ feature selection using the Optimization Algorithm (BPOA). Once the optimal features are identified, we employ the Densenet201 model to categorize attacks across various datasets, including Bot-IoT, CICIDS2017, and CICIDS2019, through deep learning methodologies. To address the challenge posed by imbalanced data, we introduce Conditional Generic Adversarial Networks (CGAN) for generating additional data samples for minority classes, thus mitigating the issue. In contrast to recent intrusion detection methods, our results showcase the model's exceptional precision in detecting and categorizing achieving accuracy rates of 99.12%, 99.01%, and 99.18% for Bot-IoT, CICIDS2017, and CICIDS2019 datasets, respectively. Despite the potential benefits of a machine learning-based intrusion detection system for IoT security, several limitations must be considered. These include the lack of standardized security protocols across various IoT devices and platforms, which makes it challenging to develop a uniform intrusion detection system. Furthermore, machine learning models, including those for intrusion detection, can be vulnerable to adversarial attacks that can circumvent or mislead the model's decision-making process. Thus, the potential for sophisticated attacks on IoT systems must be considered when developing such a system.

Effective Intrusion Detection System Using Deep Learning for DDoS Attacks

An increasing demand for information technology and cloud computing has led to various security threats over internet. Amongst all types of threats, Distributed Denial of Service (DDoS) attacks are the most common, posing a challenge to a cyber security. It allows unauthorized users to gain access to services, and preventing authorized users. Traditional intrusion detection, antivirus software, and firewalls are not enough to detect these attacks. This paper proposed an efficient deep learning-based intrusion detection system (IDS) for DDoS attacks detection. Proposed model is a hybrid CNN-LSTM model which is combination of best DL algorithms to take advantage of CNN to extract spatial features and LSTM to extract temporal features. The real-time DDoS-specific benchmark-dataset CICDDoS2019 used for training, testing, and validation. An autoencoder has been used for dimensionality reduction, and SMOTE method is used to balance the minority class of dataset. The experimental results proved that the model outperforms than other state-of-the-art models, with an accuracy score of 99.86%.

Machine Learning-Based Intrusion Detection System for Encrypted Attacks

In today's society, information and communication technology is developing rapidly. With the gradual maturity and popularization of encryption technology, more and more malicious attacks are also using encryption technology to evade the scrutiny of traditional traffic detection systems. Therefore, accurate identification of encrypted attacks has become a research hotspot in the international community. This paper proposes an encrypted traffic detection method based on convolutional neural network (CNN) technology to address the issues of tedious steps and low recognition accuracy in manually extracting traffic features. This method does not require manual or expert feature extraction, and can automatically extract advanced features through CNNs, which are then fed into XGBoost classifiers for classification processing. On the basis of the above methods, this article designs and implements an encrypted traffic intrusion detection system, which is divided into five parts: traffic collection, data processing, model detection, data visualization, and traffic blocking. Reasonable explanations and technical introductions are provided for these modules.

Machine learning-based intrusion detection system for detecting web attacks

<p>The increasing use of smart devices results in a huge amount of data, which raises concerns about personal data, including health data and financial data. This data circulates on the network and can encounter network traffic at any time. This traffic can either be normal traffic or an intrusion created by hackers with the aim of injecting abnormal traffic into the network. Firewalls and traditional intrusion detection systems detect attacks based on signature patterns. However, this is not sufficient to detect advanced or unknown attacks. To detect different types of unknown attacks, the use of intelligent techniques is essential. In this paper, we analyse some machine learning techniques proposed in recent years. In this study, several classifications were made to detect anomalous behaviour in network traffic. The models were built and evaluated based on the Canadian Institute for Cybersecurity-intrusion detection systems dataset released in 2017 (CIC-IDS-2017), which includes both current and historical attacks. The experiments were conducted using decision tree, random forest, logistic regression, gaussian naïve bayes, adaptive boosting, and their ensemble approach. The models were evaluated using various evaluation metrics such as accuracy, precision, recall, F1-score, false positive rate, receiver operating characteristic curve, and calibration curve.</p>