Learning Based Intrusion Detection System Research Articles

A novel deep learning based intrusion detection system for the IoT-Cloud platform with blockchain and data encryption mechanisms

The Internet of Things (IoT) integrated Cloud (IoT-Cloud) has gotten much attention in the past decade. This technology’s rapid growth makes it even more critical. As a result, it has become critical to protect data from attackers to maintain its integrity, confidentiality, protection, privacy, and the procedures required to handle it. Existing methods for detecting network anomalies are typically based on traditional machine learning (ML) models such as linear regression (LR), support vector machine (SVM), and so on. Although these methods can produce some outstanding results, they have low accuracy and rely heavily on manual traffic feature design, which has become obsolete in the age of big data. To overcome such drawbacks in intrusion detection (ID), this paper proposes a new deep learning (DL) model namely Morlet Wavelet Kernel Function included Long Short-Term Memory (MWKF-LSTM), to recognize the intrusions in the IoT-Cloud environment. Initially, to maintain a user’s privacy in the network, the SHA-512 hashing mechanism incorporated a blockchain authentication (SHABA) model is developed that checks the authenticity of every device/user in the network for data uploading in the cloud. After successful authentication, the data is transmitted to the cloud through various gateways. Then the intrusion detection system (IDS) using MWKF-LSTM is implemented to identify the type of intrusions present in the received IoT data. The MWKF-LSTM classifier comes up with the Differential Evaluation based Dragonfly Algorithm (DEDFA) optimal feature selection (FS) model for increasing the performance of the classification. After ID, the non-attacked data is encrypted and stored in the cloud securely utilizing Enhanced Elliptical Curve Cryptography (E2CC) mechanism. Finally, in the data retrieval phase, the user’s authentication is again checked to ensure user privacy and prevent the encrypted data in the cloud from intruders. Simulations and statistical analysis are performed, and the outcomes prove the superior performance of the presented approach over existing models.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The industrial internet of things (IIoT) is an evolutionary extension of the traditional Internet of Things (IoT) into processes and machines for applications in the industrial sector. The IIoT systems generate a large amount of private and sensitive data i.e., stored and processed somewhere on the cloud-edge continuum. The IIoT devices, and the IIoT networks are subject to security mechanisms such as intelligent Intrusion Detection and Prevention Systems (IDS/IPS) systems, that can detect and respond unseen malicious network attacks. The adoption of centralized machine learning methods for IDS has become impractical due to the high computational cost and privacy concerns associated with storing large amounts of data on a single server along the cloud-edge continuum. The combination of federated learning and Blockchain has emerged as a promising advancement in addressing the challenge. Federated learning distributes learning to individual IIoT devices without compromising data privacy, while Blockchain enhances privacy and security. Many academic and industrial efforts outline IDS mechanisms using machine learning, deep learning, federated learning, and Blockchain technologies. The utilization of federated learning-based IDS has become increasingly popular and is now being applied to various tasks including IDS/IPS systems. However, existing intrusion detection systems (IDSs) survey are limited to the scope of classical machine learning and deep learning. To address this limitation, we analyze the IIoT literature that integrates Blockchain and federated learning to enhance IDSs and improve its threat detection capabilities. This survey explores the role of Blockchain and federated learning in addressing security and privacy issues, particularly those associated with IDS/IPS in IIoT networks. Insights on the possibilities of machine learning, federated learning, and Blockchain in supporting IDS to monitor IIoT network traffic for anomaly detection are discussed in detail through state of the art. Furthermore, we provide a set of recommendation based on our literature for the effective implementation of a Blockchain and federated learning-based network intrusion detection system. Finally, we summarize the study and highlight challenges as future research directions for Blockchain and Federated Learning-based technologies for cybersecurity and intrusion detection in IIoT.

Machine Learning-Based Intrusion Detection System for Cyber Attacks in Private and Public Organizations

Cyber-attacks have proven to be a force for hacking groups and state-sponsored organizations seeking to level the playing field with competitors. The hacker threat paired with the enormously hazardous and costly danger of fraud or intellectual property theft by insiders has created a volatile situation in private and public organizations. While a majority of internal breaches are due to employee negligence or human error, attacks by malicious insiders with access to sensitive company information have increased dramatically in recent years. Threats of financial loss, theft of sensitive information, and destruction to critical sectors have made cybersecurity a top security priority around the globe. Whereas the increase in frequency and complexity of attacks on the industry has increased the danger of being unprepared, it also has influenced the cost of preventing and recovering from cyber-attacks. To construct a machine learning bases instruction detection system is capable of detecting Cyber-attacks in the private and public sectors in Nigeria and the whole world. The results show that Random Forest and Random Tree algorithms outperform the other algorithms in their level of precision and F-measure as they are above 99% and 98% respectively, while the Random Forest outperforms the others by its detection rate. However, the Random Forest and Random Tree algorithms are more efficient in performing classification exercise on the Test datasets

Hybrid deep learning based intrusion detection system using Modified Chicken Swarm Optimization algorithm

Web Systems which are the backbone of information resources, communications, and personal information management, attackers might take advantage of their vulnerability and beguile them to get access to sensitive data or the web servers and apps in full. Wider usage of the Internet and its features have come a long ago, with both advantages and disadvantages. The security and its side effects have been discussed by researchers in various aspects of the network. HTTP, one of the most widely used network protocols, has paid a huge price due to various intrusions like SQL injections, code injections, and cross-site scripting (XSS). To handle these intrusions, various intrusion detection algorithms have been proposed and addressed in the literature. The accuracy and timeliness of these detections has been an issue due to false positives and the amount of information that ought to be processed and delivered within a short span of time. In recent times the classic classifiers have become outdated and detecting abnormal traffic in a web system has become a hassle. In this research, we propose handling intrusion detection over a Web System using hybrid Deep Learning (HDL) based classification and robust feature extraction using a modified chicken swarm optimization algorithm (MCSO). This approach also incorporates the idea of deep learning, which makes it possible to have a peer-to-peer learning system for aberrant patterns with a fewer number of characteristics, hence reducing the amount of time needed to complete the work. In order to distinguish or classify data that the web system has to deal with, a hybrid computational intelligence-based classifier algorithm is used. The combination of the hybrid classifier is fuzzy neural network with Long Short Term Memory (LSTM) which is basically used to classify the attacks and distinguish between normal and anomalous data. The use of helps in understanding the nature of intrusions over time, which is constant and predictable, On the other hand, with the assistance of deep learning and a method called feature extraction, which pulls important information from noisy data, we can do this. Lastly, the findings of the experiments show that this technique has an excellent detection performance, with an accuracy rate that is more than 98.7%.

Аналитический обзор подходов к обнаружению вторжений, основанных на федеративном обучении: преимущества использования и открытые задачи

To provide an accurate and timely response to different types of attacks, intrusion detection systems collect and analyze a large amount of data, which may include information with limited access, such as personal data or trade secrets. Consequently, such systems can be seen as an additional source of risks associated with handling sensitive information and breaching its security. Applying the federated learning paradigm to build analytical models for attack and anomaly detection can significantly reduce such risks because locally generated data is not transmitted to any third party, and model training is done locally - on the data sources. Using federated training for intrusion detection solves the problem of training on data that belongs to different organizations, and which, due to the need to protect commercial or other secrets, cannot be placed in the public domain. Thus, this approach also allows us to expand and diversify the set of data on which machine learning models are trained, thereby increasing the level of detectability of heterogeneous attacks. Due to the fact that this approach can overcome the aforementioned problems, it is actively used to design new approaches for intrusion and anomaly detection. The authors systematically explore existing solutions for intrusion and anomaly detection based on federated learning, study their advantages, and formulate open challenges associated with its application in practice. Particular attention is paid to the architecture of the proposed systems, the intrusion detection methods and models used, and approaches for modeling interactions between multiple system users and distributing data among them are discussed. The authors conclude by formulating open problems that need to be solved in order to apply federated learning-based intrusion detection systems in practice.

Federated reinforcement learning based intrusion detection system using dynamic attention mechanism

Due to the recent advancements in the Internet of Things (IoT) and cloud computing technologies, the detection and prevention of intrusions in enterprise networks have become a crucial and challenging task. Real-time monitoring of network traffic and resources is required to protect those networks from intrusions. An Intrusion Detection System (IDS) analyses the data packets from the network and the system-level applications to detect any malicious activity. However, existing IDSs require all the data, collected at different network nodes, to be collated at one central location to perform the analysis for any model development. This approach hampers the data privacy at the network nodes as the data needs to be shared with other nodes. Furthermore, many of the existing IDSs are unable to adapt to evolving attack patterns, which may result in poor network vulnerability detection and significant degradation in the performance of the systems. To address these limitations, we present a Federated Deep Reinforcement Learning-based IDS in which multiple agents are deployed on the network in a distributed fashion, and each of these agents runs a Deep Q-Network logic. We considered the data privacy concerns of each agent while designing the system. In our system, the data at each agent node is not shared with any other nodes. At the same time, however, all the agents in the system benefit, via the attention weighted model aggregation process, from the distribution and pattern of the data available at all the other agents. We have also developed an attention mechanism that dynamically determines attention value of an agent, which is used in the model aggregation process. Our model can be scaled to large networks and is resistant to hardware or network failures at any agent node. We have tested and evaluated our proposed system on the cloud-based ISOT-CID dataset and the standard benchmark NSL-KDD dataset. The experimental findings demonstrate the performance and robustness of our proposed model in terms of metrics like accuracy, precision, false-positive rate, and area under the ROC curve.

FL-IIDS: A novel federated learning-based incremental intrusion detection system

With the advantage of analyzing data of multiple work sites comprehensively while ensuring data privacy, federated learning-based intrusion detection systems (IDS) are emerging as a distributed intrusion detection paradigm. Most of these IDS are assumed to work on static data. However, in the actual network environment, the practice of setting data as static will lead to the phenomenon known as catastrophic forgetting, where old classes that have already appeared would be forgotten. In this paper, we propose a novel IDS framework called FL-IIDS to effectively address the catastrophic forgetting problem. Firstly, a new loss function is synthetically designed for local model training. With the new function, the class gradient balance loss function assigns different learning weights to data of the new and old classes so that the learning rate of the new classes would decrease and the memory of the overall old classes would be deepened. Moreover, the sample label smoothing loss function leverages the knowledge distillation method to enhance the local model memory for every specific class of old classes. Secondly, the relay client fusing sample reconstruction is employed to mitigate the spread of catastrophic forgetting globally without compromising data privacy. Extensive experimental results on the UNSW-NB15 dataset and the CICIDS2018 dataset show that our proposed framework improves the memory capability for old classes substantially without affecting the detection effectiveness of the IDS for new classes.

Recursive Feature Elimination with Cross-Validation with Decision Tree: Feature Selection Method for Machine Learning-Based Intrusion Detection Systems

The frequency of cyber-attacks on the Internet of Things (IoT) networks has significantly increased in recent years. Anomaly-based network intrusion detection systems (NIDSs) offer an additional layer of network protection by detecting and reporting the infamous zero-day attacks. However, the efficiency of real-time detection systems relies on several factors, including the number of features utilized to make a prediction. Thus, minimizing them is crucial as it implies faster prediction and lower storage space. This paper utilizes recursive feature elimination with cross-validation using a decision tree model as an estimator (DT-RFECV) to select an optimal subset of 15 of UNSW-NB15’s 42 features and evaluates them using several ML classifiers, including tree-based ones, such as random forest. The proposed NIDS exhibits an accurate prediction model for network flow with a binary classification accuracy of 95.30% compared to 95.56% when using the entire feature set. The reported scores are comparable to those attained by the state-of-the-art systems despite decreasing the number of utilized features by about 65%.

Overview and Exploratory Analyses of CICIDS 2017 Intrusion Detection Dataset

Intrusion detection systems are used to detect attacks on a network. Machine learning (ML) approaches have been widely used to build such intrusion detection systems (IDSs) because they are more accurate when built from a very large and representative dataset. Recently, one of the benchmark datasets that are used to build ML-based intrusion detection models is the CICIDS2017 dataset. The data set is contained in eight groups and was collected from the Data Set & Repository of the Canadian Institute of Cyber Security. The data set is available in both PCAP and net flow formats. This study used the net flow records in the CIDIDS2017 dataset, as they were found to contain newer attacks, very large, and useful for traffic analysis. Exploratory data analysis (EDA) techniques were used to reveal various characteristics of the dataset. The general objective is to provide more insight into the nature, structure, and issues of the data set so as to identify the best ways to use it to achieve improved ML-based IDS models. Furthermore, some of the open problems that can arise from the use of the dataset in any machine learning-based intrusion detection systems are highlighted and possible solutions are briefly discussed. The EDA techniques used revealed important relationships between the input variables and the target class. The study concluded that the EDA can better influence the decision about future IDS research using the dataset.

RAIDS: Robust autoencoder-based intrusion detection system model against adversarial attacks

Machine learning-based intrusion detection systems (IDS) are essential security functions in conventional and software-defined networks alike. Their success and the security of the networks they protect depend on the accuracy of their classification results. Adversarial attacks against machine learning, which seriously threaten any IDS, are still not countered effectively. In this study, we first develop a method that employs generative adversarial networks to produce adversarial attack data. Then, we propose RAIDS, a robust IDS model, designed to be resilient against adversarial attacks. In RAIDS, an autoencoder's reconstruction error is used as a prediction value for a classifier. Also, to prevent the attacker from guessing about the feature set, multiple feature sets are created and used to train baseline machine learning classifiers. A LightGBM classifier is then trained with the results produced by two autoencoders and an ensemble of baseline machine learning classifiers. The results show that the proposed robust model can increase overall accuracy by at least 13.2% and F1-score by more than 110% against adversarial attacks without the need for adversarial training.

Deep Reinforcement Learning for intrusion detection in Internet of Things: Best practices, lessons learnt, and open challenges

The Internet of Things (IoT) scenario places important challenges even for deep learning-based intrusion detection systems. IoTs are highly heterogeneous networks in which multiple types of nodes and connections between them proliferate at a fast pace. From a deep learning perspective, such complexity translates into dynamic feature spaces where the extraction of semantic patterns and correlations among features may require sophisticated inductive biases to be learnt by gradient-based techniques. The research community has recently suggested using Deep Reinforcement Learning (DRL) as a potent approach to effectively identify cyber-threat attempts in IoTs.DRL consists of a Markov Decision Process-based meta-model that permits solving high-dimensional combinatorial optimization problems where differentiable supervisory signals may be absent. For this reason, multiple intelligent intrusion detection systems have been proposed for the IoT environment where high-level requirements are been pursued alongside the detection accuracy. These goals are related to optimizing the computational overhead, reducing power consumption at the edge, and preserving the privacy of sensitive information, among others.This survey offers a clear bird’s eye view of the most recent design choices for DRL-based intrusion detection systems with a focus on the specific context of IoT. Our aim is not only to offer an exhaustive taxonomy of design alternatives made by DRL practitioners in the field of Intrusion detection, but also to discuss the advantages and the effective deployment of each setting concerning real IoT environments. We hope this work would guide the researchers interested in Intrusion Detection for IoTs to establish solid criteria for the most effective usage of Deep Reinforcement Learning in their future work.

Machine learning based intrusion detection system for IoMT

Machine learning based intrusion detection system for IoMT

A novel dimensionality reduction and optimal deep learning based intrusion detection system for internet of things

The internet of things (IoT) has significantly influenced day-to-day life in large industrial systems. The Internet of Things (IoT) offers a platform for information systems to integrate effectively with network servers. In contrast, cyber threats are becoming critical, especially for IoT servers. A strong strategy must be in place to protect the network system from multiple attacks. In order to detect malicious behaviors that deteriorate network performance, an intrusion detection system (IDS) is crucial. An IDS use a detection method to monitor network activity to alert IoT users regularly. This paper proposes a novel IDS for IoT using log-sigmoid kernel principal component analysis (LSK-PCA) and activation updated deep feed-forward neural network (AU-DFFNN) based dimensionality reduction (DR) and classification technique. Initially, the input data is taken from the NSLKDD dataset and undergoes pre-processing. Afterwards, attribute extraction is carried out, followed by Fisher’s Yates Adapted Golden Eagle Optimizer (FY-GEO) based feature selection. Then, DR of the feature selected data is done using the LSK-PCA model. Finally, the reduced dataset is given as an input to the classifier for classifying the data as attacked and normal data. As a final point, experimental analysis is performed using performance metrics like precision (PR), recall (RC), f-score (FS), accuracy (AC), false alarm rate (FAR) and computational time (CT). The results proved that the proposed work detects intrusion effectively compared to state-of-art techniques.

A review of deep learning based intrusion detection systems

Network security is a key issue in the era of rapid Internet development and new technologies are needed to enhance the security protection of network systems. As the first line of defence for the security of network systems, IDS is considered to be one of the important network tools for managing network security. Traditional network intrusion detection methods usually use machine learning techniques. However, deep learning, a more powerful machine learning method, has the advantages of mature technology, wide applicability and high accuracy, and has shown its advantages in various fields such as image recognition, natural language processing and computer vision. It can also be applied to network security detection, as it can effectively handle large-scale, complex datas and detect unknown, sophisticated network attacks. This paper will provide a summary of machine learning techniques and deep learning techniques in intrusion detection systems, as well as examples of IDSs using deep learning, and conclude with a summary and outlook.

Performance Evaluation and Validation of Intelligent Security Mechanism in Software Defined Network

Network attacks are discovered using intrusion detection systems (IDS), one of the most crucial security solutions. Machine learning techniques-based intrusion detection approaches have been rapidly created as a result of the widespread use of standard machine learning algorithms in the security field. Unfortunately, as technology has advanced and there have been faults in the machine learning-based intrusion detection system, the system has consistently failed to fulfill the standards for cyber security. Generative adversarial networks (GANs) have drawn a lot of interest recently and have been utilized widely in anomaly detection due to their enormous capacity for learning difficult high-dimensional real time data distribution. Traditional machine learning algorithms for intrusion detection have a number of drawbacks that deep learning techniques can significantly mitigate. With the help of a real time dataset, this work suggests employing GANs and its variants to detect network intrusions in SDN. The feasibility and comparison results are also presented. For different kinds of datasets, the BiGAN outcomes outperform the GAN.

Machine Learning based intrusion detection systems for connected autonomous vehicles: A survey

Machine Learning based intrusion detection systems for connected autonomous vehicles: A survey

On the Feasibility of Split Learning, Transfer Learning and Federated Learning for Preserving Security in ITS Systems

Due to the absence of distinct boundaries, wireless networks are vulnerable to a variety of intrusions. As the number of intruders has increased, the risks on critical infrastructures monitored by networked systems have also increased. Protecting shared information using effective and robust Intrusion Detection Systems (IDSs) remains a critical issue, especially with the growing implementation of vehicular networks. Building an IDS that detects threats efficiently with maximum accuracy and detection is a challenging undertaking. Machine Learning (ML) mechanisms have been successfully adopted in IDSs to detect a variety of network intruders. Split learning is considered one of the main developments in creating efficient ML approaches. In utilizing the Split Learning approach, an IDS is successful in performing at higher accuracy, and detection rate as well as a higher classification performance (Precision, Recall). In this work, a Split Learning-based IDS (SplitLearn) for Intelligent Transportation System (ITS) infrastructures has been proposed to address the potential security concerns. The proposed model has been evaluated and compared against other models (i.e., Federated Learning (FedLearn) and Transfer Learning (TransLearn)-based solutions). With the highest accuracy and detection rates, the proposed model (SplitLearn) outperforms FedLearn and TransLearn by 2 to 5 % respectively. We also see a decrease in power consumption when utilizing SplitLearn versus FedLearn.

A Survey on Machine and Deep Learning Based Intrusion Detection Systems for IoT

Abstract: In recent times, the Internet of Things (IoT) and its diverse range of applications have emerged as one of the most popular and highly researched areas. The characteristics that make IoT easily applicable to real-life applications also expose it to cyber threats, thereby emphasizing the need for effective security measures. The rapid advancement of IoT is revolutionizing business processes and society as a whole. However, as this technology continues to evolve, it becomes increasingly important to prioritize the detection and awareness of vulnerabilities. Adopting a proactive approach is crucial to prevent unauthorized access to critical resources and business functions, thereby ensuring the continuous availability and operation of the system. Failing to prevent the occurrence of DoS and DDoS attacks can have adverse effects on data confidentiality, integrity, and availability, thereby highlighting the importance of effective intrusion detection and prevention measures. The literature has presented a wide range of intrusion detection methods aimed at addressing computer security threats. These methods can generally be categorized into

A Study on Heuristic Algorithms Combined With LR on a DNN-Based IDS Model to Detect IoT Attacks

Current security challenges are made more difficult by the complexity and difficulty of spotting cyberattacks due to the Internet of Things explosive growth in connected devices and apps. Therefore, various sophisticated attack detection techniques have been created to address these issues in recent years. Due to their effectiveness and scalability, machine learning-based intrusion detection systems (IDSs) have increased. However, several factors, such as the characteristics of the training dataset and the training model, affect how well these AI-based systems identify attacks. In particular, the heuristic algorithms (GA, PSO, CSO, FA) optimized by the logistic regression (LR) approach employ it to pick critical features of a dataset and deal with data imbalance problems. This study offers an intrusion detection system (IDS) based on a deep neural network and heuristic algorithms combined with LR to boost the accuracy of attack detections. Our proposed model has a high attack detection rate of up to 99% when testing on the IoT-23 dataset.

Detection of Cyber Attacks using Machine Learning ‎based Intrusion Detection System for IoT Based Smart ‎Cities

The world’s dynamics is evolving with artificial intelligence (AI) and the results are smart products. A smart city has smart city is collection of smart innovations powered with AI and internet of things (IoTs). Along with the ease and comfort that the concept of a smart city pointed at, many security concerns are being raised that hinders the path of its flourishment. An Intrusion Detection System (IDS) monitors the whole network traffic and alerts in case of any anomaly. A Machine Learning-based IDS intelligently senses the network threats, takes decisions about data packet legibility and alarm the user. Researchers have deployed various ML techniques to IDS to improve the detection accuracy. This work presents a comparative analysis of various ML algorithms trained over UNSW-NB15 dataset. ADA Boost, Linear Support Vector Machine (LSVM), Auto Encoder Classifier, ‎Quadratic Support Vector Machine (QSVM) and Multi-Layer Perceptron algorithms are being employed in the stimulation. ADA Boost showed an excellent accuracy of 98.3% in the results.