Learning Based Intrusion Detection System Research Articles

Investigating on the robustness of flow-based intrusion detection system against adversarial samples using Generative Adversarial Networks

Recently, Software Defined Networking (SDN) has emerged as the key technology in programming and orchestrating security policy in the security operations centers (SOCs) for heterogeneous networks. Typically, machine learning-based intrusion detection systems (ML-IDS) have been deployed and associated with SDN to leverage the features of a programmable network to defend against sophisticated cyberattacks in anomaly detection. Unfortunately, such ML-based IDSs are easily vulnerable to adversarial attacks due to the lack of diverse forms of malicious records in the training dataset. The missing data sample in the training phase can lead to a lower detection rate in real-world scenarios with adversarial settings. In this paper, we explore the ability of Wasserstein Generative Adversarial Networks with Gradient Penalty (WGAN-GP), WGAN-GP with two timescale update rule (WGAN-GP TTUR), and AdvGAN in generating perturbed attack samples to bypass attack detectors. Then, this approach is used to continuously evaluate the robustness of ML-based IDSs and then upgrade them as a service in SDN. The experimental results on CICIDS2018 and InSDN datasets demonstrate that generated adversarial samples can be used to fool targeted IDS. Later, those created samples can supplement the original ones in retraining IDS to improve the resilience of the attack detector.

Hybrid Intrusion Detection System Based on Combination of Random Forest and Autoencoder

To cope with the rising threats posed by network attacks, machine learning-based intrusion detection systems (IDSs) have been intensively researched. However, there are several issues that need to be addressed. It is difficult to deal with unknown attacks that do not appear in the training set, and as a result, poor detection rates are produced for these unknown attacks. Furthermore, IDSs suffer from high false positive rate. As different models learn data characteristics from different perspectives, in this work we propose a hybrid IDS which leverages both random forest (RF) and autoencoder (AE). The hybrid model operates in two steps. In particular, in the first step, we utilize the probability output of the RF classifier to determine whether a sample belongs to attack. The unknown attacks can be identified with the assistance of the probability output. In the second step, an additional AE is coupled to reduce the false positive rate. To simulate an unknown attack in experiments, we explicitly remove some samples belonging to one attack class from the training set. Compared with various baselines, our suggested technique demonstrates a high detection rate. Furthermore, the additional AE detection module decreases the false positive rate.

Intrusion Detection System Based on One-Class Support Vector Machine and Gaussian Mixture Model

Intrusion detection systems (IDSs) play a significant role in the field of network security, dealing with the ever-increasing number of network threats. Machine learning-based IDSs have attracted a lot of interest owing to their powerful data-driven learning capabilities. However, it is challenging to train the supervised learning algorithms when there are no attack data at hand. Semi-supervised anomaly detection algorithms, which train the model with only normal data, are more suitable. In this study, we propose a novel semi-supervised anomaly detection-based IDS that leverages the capabilities of representation learning and two anomaly detectors. In detail, the autoencoder (AE) is applied to extract representative features of normal data in the first step, and then two semi-supervised detectors, the one-class support vector machine (OCSVM) and Gaussian mixture model (GMM), are trained on the derived features. The two detectors collaborate to detect anomalous samples. The OCSVM predicts the abnormal samples initially, and after that, the GMM is applied to recheck the misclassified samples further. The experiments demonstrate that the AE improves the detection rate, and two detectors are more promising than a single one.

Data driven intrusion detection for 6LoWPAN based IoT systems

Wide adoption of Internet of Things (IoT) devices and their limitations in terms of hardware cause them to be easy targets for attackers. This, in turn, requires monitoring such systems using intrusion detection systems and take mitigative actions against insider and outsider attackers. Recent studies have explored that machine learning based intrusion detection systems are quite successful in detecting different types of cyber threats targeting IoT systems. However, the proposed systems in these studies incurred limitations in terms of the characteristics of their datasets and detection models. Specifically, a big proportion of the proposed models were developed using simulation-based data generated through specific simulators. Some of these studies also used previously published testbed data that contain the samples of outdated IoT attacks and vulnerabilities. Furthermore, they focused on a lower attack variety and proposed binary classifiers which do not scale in multi-attack scenarios. In this study, we propose a machine learning based multi-class classifier that can classify 6 attack types together with the benign traffic. Our node based feature extraction and detection methodology allows locating the network addresses of the attackers, rather than a rough network level attack existence information, by modeling their traffic characteristics over a sliding time window. For training and testing our models, we also propose an intrusion detection dataset generated using the traffic data collected from real IoT devices running with 6LoWPAN and RPL protocols. Besides having RPL routing attacks in the dataset, we leverage Mirai botnet, employed frequently to target IoT devices. The results show that the proposed intrusion detection system can detect 6 attack types with high recall scores ranging from 79% to 100%. We also illustrate the practicality of the developed model via deployment in a proof of concept implementation over a testbed.

EIFDAA: Evaluation of an IDS with function-discarding adversarial attacks in the IIoT

The complexity of the Industrial Internet of Things (IIoT) presents higher requirements for intrusion detection systems (IDSs). An adversarial attack is a threat to the security of machine learning-based IDSs. For such a complex situation, this paper analyses adversarial attackers’ ability to deceive IDSs used in the IIoT and proposes the evaluation of an IDS with function-discarding adversarial attacks in the IIoT (EIFDAA), a framework that can evaluate the defence performance of machine learning-based IDSs against various adversarial attack algorithms. This framework is composed of two main processes: adversarial evaluation and adversarial training. Adversarial evaluation can diagnose IDS that is unfitting in adversarial environments. Then, adversarial training is used to treat the weak IDS. In this framework, five well-known adversarial attacks, the fast-gradient sign method (FGSM), basic iterative method (BIM), projected gradient descent (PGD), DeepFool and Wasserstein generative adversarial network with gradient penalty (WGAN-GP) are used to convert attack samples into adversarial samples to simulate the adversarial environment. This study evaluates the capability of mainstream machine learning techniques as intrusion detection models to defend against adversarial attacks, and retrains these detectors to improve the robustness of IDSs through adversarial training. In addition, the framework includes an adversarial attack model that discards the attack function of the attack samples in the IIoT. Through the experimental results on the X-IIoTID dataset, the dropped adversarial detection rate of these detectors to nearly zero demonstrates that an adversarial attack has black-box attack capabilities for these IDSs. Additionally, the improved IDSs retrained with adversarial samples can effectively defend against adversarial attackers while maintaining the original detection rate for the attack samples. EIFDAA is expected to be a solution that can be applied to IDS for improving the robustness in the IIoT.

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network.

Intrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied, several machine learning-based IDSs have been developed. In this study, we focused on one such model involving several algorithms and used the NSL-KDD dataset as a benchmark to train and evaluate its performance. We demonstrate a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN)-i.e., an architecture based on a deep-learning algorithm capable of creating generative models-was implemented. Furthermore, we tested the IDS performance using the generated adversarial traffic. The results showed that, even in the case of the GAN-generated traffic (which could successfully evade IDS detection), by using the adversarial traffic in the testing process, we could improve the machine learning-based IDS performance.

2DF-IDS: Decentralized and differentially private federated learning-based intrusion detection system for industrial IoT

Advanced technologies, such as the Internet of Things (IoT) and Artificial Intelligence (AI), underpin many of the innovations in Industry 4.0. However, the interconnectivity and open nature of such systems in smart industrial facilities can also be targeted and abused by malicious actors, which reinforces the importance of cyber security. In this paper, we present a secure, decentralized, and Differentially Private (DP) Federated Learning (FL)-based IDS (2DF-IDS), for securing smart industrial facilities. The proposed 2DF-IDS comprises three building blocks, namely: a key exchange protocol (for securing the communicated weights among all peers in the system), a differentially private gradient exchange scheme (achieve improved privacy of the FL approach), and a decentralized FL approach (that mitigates the single point of failure/attack risk associated with the aggregation server in the conventional FL approach). We evaluate our proposed system through detailed experiments using a real-world IoT/IIoT dataset, and the results show that the proposed 2DF-IDS system can identify different types of cyber attacks in an Industrial IoT system with high performance. For instance, the proposed system achieves comparable performance (94.37%) with the centralized learning approach (94.37%) and outperforms the FL-based approach (93.91%) in terms of accuracy. The proposed system is also shown to improve the overall performance by 12%, 13%, and 9% in terms of F1-score, recall, and precision, respectively, under strict privacy settings when compared to other competing FL-based IDS solutions.

An Investigation of Machine Learning based Intrusion Detection System in Mobile Ad hoc Network

An Investigation of Machine Learning based Intrusion Detection System in Mobile Ad hoc Network

Enhanced Coyote Optimization with Deep Learning Based Cloud-Intrusion Detection System

Cloud Computing (CC) is the preference of all information technology (IT) organizations as it offers pay-per-use based and flexible services to its users. But the privacy and security become the main hindrances in its achievement due to distributed and open architecture that is prone to intruders. Intrusion Detection System (IDS) refers to one of the commonly utilized system for detecting attacks on cloud. IDS proves to be an effective and promising technique, that identifies malicious activities and known threats by observing traffic data in computers, and warnings are given when such threats were identified. The current mainstream IDS are assisted with machine learning (ML) but have issues of low detection rates and demanded wide feature engineering. This article devises an Enhanced Coyote Optimization with Deep Learning based Intrusion Detection System for Cloud Security (ECODL-IDSCS) model. The ECODL-IDSCS model initially addresses the class imbalance data problem by the use of Adaptive Synthetic (ADASYN) technique. For detecting and classification of intrusions, long short term memory (LSTM) model is exploited. In addition, ECO algorithm is derived to optimally fine tune the hyperparameters related to the LSTM model to enhance its detection efficiency in the cloud environment. Once the presented ECODL-IDSCS model is tested on benchmark dataset, the experimental results show the promising performance of the ECODL-IDSCS model over the existing IDS models.

Mitigate Volumetric DDoS Attack using Machine Learning Algorithm in SDN based IoT Network Environment

Software-Defined Networking (SDN) is a recent trend that is combined with Internet of Things (IoT) in wireless network applications. SDN focus entirely on the upper-level network management and IoT enables monitoring the physical activity of the real-time environment via internet network connectivity. The IoT clusters with SDN often undergoes challenges like network security concerns like getting attacked by a Distributed Denial of Service (DDoS). The mitigation of network management issues is carried out by the frequent software update of SDN. On other hand, the security enhancement is needed to all alleviate the mitigation of security attacks in the network. With such motivation, the research uses machine learning based intrusion detection system to mitigate the DDoS attack in SDN-IoT network. The control layer in the SDN is responsible for the prevention of attacks in IoT network using a strong Intrusion Detection System (IDS) framework. The IDS enables a higher-level attack resistance to the DDoS attack as the framework involves feature selection-based classification model. The simulation is conducted to test the efficacy of the model against various levels of DDoS attacks. The results of simulation show that the proposed method achieves better classification of attacks in the network than other methods.

A Fused Machine Learning Approach for Intrusion Detection System

The rapid growth in data generation and increased use of computer network devices has amplified the infrastructures of internet. The interconnectivity of networks has brought various complexities in maintaining network availability, consistency, and discretion. Machine learning based intrusion detection systems have become essential to monitor network traffic for malicious and illicit activities. An intrusion detection system controls the flow of network traffic with the help of computer systems. Various deep learning algorithms in intrusion detection systems have played a prominent role in identifying and analyzing intrusions in network traffic. For this purpose, when the network traffic encounters known or unknown intrusions in the network, a machine-learning framework is needed to identify and/or verify network intrusion. The Intrusion detection scheme empowered with a fused machine learning technique (IDS-FMLT) is proposed to detect intrusion in a heterogeneous network that consists of different source networks and to protect the network from malicious attacks. The proposed IDS-FMLT system model obtained 95.18% validation accuracy and a 4.82% miss rate in intrusion detection.

Anomaly-Based Intrusion Detection System using One-Dimensional Convolutional Neural Network

As technologies in information and virtualization evolve, the volume of security threats attempting to cause damage to systems grows and becomes more powerful, which highlights the importance of Intrusion Detection Systems (IDS) to have an essential role in network security and help in detecting malicious attacks from network traffic. The most widely used network anomaly detection systems are based on Machine Learning (ML) techniques such as Decision Tree (DT), Support Vector Machine (SVM), and K-nearest Neighbors (KNN). Although IDSs based on ML techniques have achieved promising results and high detection rates, however, it is considered a type of shallow learning that depends mainly on feature engineering and requires large-scale data pre-processing as the size of the dataset grows. To overcome these problems, Deep learning-based IDSs are proposed because they have a better ability to extract features from huge amounts of data. In this research, an IDS model based on one-dimensional Convolution Neutron Network (CNN1D) is proposed that is able to detect anomalies with accuracy of 93.2% and F1-score of 93.1%. Entire NSL-KDD benchmark dataset was used to train this model. Achieved results are then compared to Deep Learning (DL) methods like CNN, LSTM, Recurrent Neural Network (RNN), and others to prove the proposed model's superiority over existing models in literature.

Ensemble adversarial training based defense against adversarial attacks for machine learning-based intrusion detection system

In this paper, a defence mechanism is proposed against adversarial attacks. The defence is based on an ensemble classifier that is adversarially trained. This is accomplished by generating adversarial attacks from four different attack methods, i.e., Jacobian-based saliency map attack (JSMA), projected gradient descent (PGD), momentum iterative method (MIM), and fast gradient signed method (FGSM). The adversarial examples are used to identify the robust machine-learning algorithms which eventually participate in the ensemble. The adversarial attacks are divided into seen and unseen attacks. To validate our work, the experiments are conducted using NSLKDD, UNSW-NB15 and CICIDS17 datasets. Grid search for the ensemble is used to optimise results. The parameter used for performance evaluations is accuracy, F1 score and AUC score. It is shown that an adversarially trained ensemble classifier produces better results.

An investigation of machine learning-based intrusion detection system in mobile ad hoc network

Building stable networks is one of the most demanding issues in the current era, as the world is increasingly reliant on computers and technology. The standard MANET protocols, software, and facilities presume a collaborative and networking atmosphere that does not consider protection. Intrusion detection systems (IDS) that track centralised network operations and detect malicious nodes are often used to supplement certain security because mitigation strategies are never sufficient. This study describes ML techniques for distributing valuable properties to IDS for green smart transportation on MANET. The performance of ML-IDSs and a review of their adequacy in MANETs help the users determine intrusion when learning about the MANET context. ML optimised KDD IDS. Ensemble learning in this IDS process gave anomaly scores to controlled packets. Our solution to actual MANET dataset shortages is this ML technique. ML techniques, simulation, and a functioning prototype had created a more resilient IDS for green smart transportation. ML-enhanced IDS detected and reduced MANET harmful activity. This research expanded IDS knowledge through ubiquitous learning.

Detection of DDoS Attacks Using SHAP-Based Feature Reduction

Machine learning techniques are widely used to protect cyberspace against malicious attacks. In this paper, we propose a machine learning-based intrusion detection system to alleviate Distributed Denial-of-Service (DDoS) attacks, which is one of the most prevalent attacks that disrupt the normal traffic of the targeted network. The model prediction is interpreted using the SHapley Additive exPlanations (SHAP) technique, which also provides the most essential features with the highest Shapley values. For the proposed model, the CICIDS2017 dataset from Kaggle is used for training the classification algorithms. The top features selected by the SHAP technique are used for training a Conditional Tabular Generative Adversarial Networks (CTGAN) for synthetic data generation. The CTGAN-generated data are then used to train prediction models such as Support Vector Classifier (SVC), Random Forest (RF), and Naïve Bayes (NB). The performance of the model is characterized using a confusion matrix. The experiment results prove that the attack detection rate is significantly improved after applying the SHAP feature selection technique.

Case Study on the Application of Deep Learning to Network Intruder Detection

Deep learning has seen considerable success in several application sectors. Unfortunately, little research has been done on its efficacy in the context of network intrusion detection. This article includes case studies that use deep learning to identify network anomalies both supervised and unsupervised. It has been demonstrated that deep neural networks (DNNs) outperform current machine learning-based intrusion detection systems in the presence of shifting IP addresses. We also demonstrate how auto encoders can support network anomaly detection.

Deep Learning-Based Intrusion Detection System for Internet of Vehicles

The growth of the Internet of Things (IoT) has resulted in several revolutionary applications, such as smart cities, cyber-physical systems, and the Internet of vehicles (IoV). Within the IoV infrastructure, vehicles are comprised of various electronic intelligent sensors or devices used to obtain data and communicate the necessary information with their surroundings. One of the major concerns about the implementation of these sensors or devices is data vulnerability; thus, it is necessary to present a solution that provides security, trust, and privacy to communicating entities and to secure vehicle data from malicious entities. In modern vehicles, the controller area network (CAN) is a fundamental scheme for controlling the interaction among different in-vehicle network sensors. However, not enough security features are present that support data encryption, authorization, and authentication mechanisms to secure the network from cyber or malicious intrusions such as denial of service and fuzzy attacks. An intrusion detection system is presented in this work based on the deep learning architecture to protect the CAN bus in vehicles. The VGG architecture is used and trained for different network intrusion patterns in order to detect malicious attacks. The experiments are performed using the CAN-intrusion-dataset. The experimental findings demonstrate that the presented deep learning system significantly reduces the false positive rate (FPR) compared to the conventional machine learning techniques. The overall accuracy of the system is 96% with FPR of 0.6%.

Transfer Learning-Based Intrusion Detection System for a Controller Area Network

Transfer Learning-Based Intrusion Detection System for a Controller Area Network

A hybrid deep learning-based intrusion detection system for IoT networks.

The Internet of Things (IoT) is a rapidly evolving technology with a wide range of potential applications, but the security of IoT networks remains a major concern. The existing system needs improvement in detecting intrusions in IoT networks. Several researchers have focused on intrusion detection systems (IDS) that address only one layer of the three-layered IoT architecture, which limits their effectiveness in detecting attacks across the entire network. To address these limitations, this paper proposes an intelligent IDS for IoT networks based on deep learning algorithms. The proposed model consists of a recurrent neural network and gated recurrent units (RNN-GRU), which can classify attacks across the physical, network, and application layers. The proposed model is trained and tested using the ToN-IoT dataset, specifically collected for a three-layered IoT system, and includes new types of attacks compared to other publicly available datasets. The performance analysis of the proposed model was carried out by a number of evaluation metrics such as accuracy, precision, recall, and F1-measure. Two optimization techniques, Adam and Adamax, were applied in the evaluation process of the model, and the Adam performance was found to be optimal. Moreover, the proposed model was compared with various advanced deep learning (DL) and traditional machine learning (ML) techniques. The results show that the proposed system achieves an accuracy of 99% for network flow datasets and 98% for application layer datasets, demonstrating its superiority over previous IDS models.

Unraveling the Decision-making Process Interpretable Deep Learning IDS for Transportation Network Security

The growing ubiquity of IoT-enabled devices in recent years emphasizes the critical need to strengthen transportation network safety and dependability. Intrusion detection systems (IDS) are crucial in preventing attacks on transport networks that rely on the Internet of Things (IoT). However, understanding the rationale behind deep learning-based IDS models may be challenging because they do not explain their findings. We offer an interpretable deep learning system that may be used to improve transportation network safety using IoT. To develop naturally accessible explanations for IDS projections, we integrate deep learning models with the Shapley Additive Reasons (SHAP) approach. By adding weight to distinct elements of the input data needed to develop the model, we increase the readability of so-called black box processes. We use the ToN_IoT dataset, which provides statistics on the volume of network traffic created by IoT-enabled transport systems, to assess the success of our strategy. We use a tool called CICFlowMeter to create network flows and collect data. The regularity of the flows, as well as their correlation with specific assaults, has been documented, allowing us to train and evaluate the IDS model. The experiment findings show that our explainable deep learning system is extremely accurate at detecting and categorising intrusions in IoT-enabled transportation networks. By examining data using the SHAP approach, cybersecurity specialists may learn more about the IDS's decision-making process. This enables the development of robust solutions, which improves the overall security of the Internet of Things. Aside from simplifying IDS predictions, the proposed technique provides useful recommendations for strengthening the resilience of IoT-enabled transportation systems against cyberattacks. The usefulness of IDS in defending mission critical IoT infrastructure has been questioned by security experts in the Internet of Vehicles (IoV) industry. The IoV is the primary research object in this case. Deep learning algorithms' versatility in processing many forms of data has contributed to their growing prominence in the field of anomaly detection in intrusion detection systems. Although machine learning models may be highly useful, they frequently yield false positives, and the path they follow to their conclusions is not always obvious to humans. Cybersecurity experts who want to evaluate the performance of a system or design more secure solutions need to understand the thinking process behind an IDS's results. The SHAP approach is employed in our proposed framework to give greater insight into the decisions made by IDSs that depend on deep learning. As a result, IoT network security is strengthened, and more cyber-resilient systems are developed. We demonstrate the effectiveness of our technique by comparing it to other credible methods and utilising the ToN_IoT dataset. Our framework has the best success rate when compared to other frameworks, as evidenced by testing results showing an F1 score of 98.83 percent and an accuracy of 99.15 percent. These findings demonstrate that the architecture successfully resists a variety of destructive assaults on IoT networks. By integrating deep learning and methodologies with an emphasis on explainability, our approach significantly enhances network security in IoT use scenarios. The ability to assess and grasp IDS options provides the path for cybersecurity experts to design and construct more secure IoT systems.