Intrusion Detection System Methods Research Articles

Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems

Intrusion Detection Systems (IDS) have become pivotal in safeguarding information systems against evolving threats. Concurrently, Concept Drift presents a significant challenge in machine learning, affecting the adaptability and accuracy of predictive models in dynamic environments. Understanding the synergy between IDS and Concept Drift is crucial for developing robust security systems. The motivation behind this survey is driven by the emerging complexities in cyber threats and the dynamic nature of data streams, which necessitate advanced IDS capable of adapting to Concept and Feature Drift. Our analysis reveals a glaring omission in the existing literature—the integration of Concept Drift and Feature Drift within IDS. Most studies have focused on Concept Drift in a general context or on IDS but have yet to comprehensively consider the implications of data dynamics. This oversight has led to a fragmented understanding and suboptimal approaches to tackling modern cyber threats. To address this, we propose a comprehensive review that delves into the role of machine learning in IDS, explicitly focusing on Concept and Feature Drift. We have proposed a framework that includes all the necessary components for a drift-aware IDS. The framework incorporates dynamic feature selection, adaptive learning algorithms, and continuous monitoring techniques to handle Concept Drift and Feature Drift effectively. The survey highlights state-of-the-art methodologies and current challenges in integrating these concepts. The methodology involves an exhaustive analysis of published works from 2019 to 2024, comparing and contrasting various models and approaches. This includes a detailed examination of Concept Drift-aware IDS methods, dynamic feature selection techniques, and the impact of high dimensionality in IDS. These quantitative improvements underscore the necessity for developing adaptive and resilient IDS. The survey uncovers under-represented areas in current research, paving the way for future investigations. By highlighting these gaps and providing comparative data, the survey sets a clear direction for upcoming research efforts to foster the development of more dynamic and adaptable IDS solutions. The quantitative experimental evaluation of the proposed framework is planned to be conducted in a future article, where we will assess its effectiveness and performance in real-world scenarios.

Mapping Study of Intrusion Detection System

The Network Security Monitoring System has been widely used to check many systems that supply services. A lot of monitoring tools have been developed to facilitate the monitoring of the network security. Since there are a lot of options to cater to our needs, this will cause a lot of time and resources to try each tool that is suitable with the system. In this research, we conducted a comparative analysis to analyse each tool presenting their advantages, disadvantages and the method used. The main objective of this research is to perform a systematic mapping study for the purpose to identify research topics related to network intrusion detection system, to assess the most frequently applied method of intrusion detection system, and to verify the types of cyber-attack that currently exist. Based on the 30 primary studies included in this mapping study, the findings indicated that the most intrusion detection system commonly used is the hybrid method and Data Injection has been the primary attack type in the existing system.

Enhancing Intrusion Detection Systems with Recurrent Neural Networks in D23 Deep Learning

Strong cybersecurity safeguards are increasingly necessary as the digital landscape changes to protect sensitive data and vital infrastructure. To detect and reduce any risks to network security, intrusion detection systems, or IDS, are essential. To improve the precision and effectiveness of anomaly detection, this paper suggests a novel method of intrusion detection that makes use of recurrent neural networks (RNNs). Standard intrusion detection systems (IDS) frequently depend on static rule-based systems, which may find it difficult to adjust to changing and dynamic cyber threats. On the other hand, sequence-retention neural networks, or RNNs, they have a special capacity to recognize patterns and temporal connections in sequential input. Traditional IDS methods are contrasted with the suggested system, which is assessed using common datasets. The RNN-based IDS is successful at detecting known and unknown threats while reducing false positives, according to preliminary data.

Swarm optimized differential evolution and probabilistic extreme learning based intrusion detection in MANET

MANETs are an attracting mechanism foSr several applications, to name a few being rescue functioning, environmental surveillance and so on due to the reason that they allow users to communicate without the utilization of persistent framework. This pliability, although creates additional security proneness. As a consequence of its advantages and growing insistence, MANETs have fascinated a lot of attentiveness from the scientific research community. In spite of that, exposed or unprotected to be more susceptible to several attacks that perpetrate destruction on their performance than any network. Conventional cryptography mechanisms cannot completely safeguard MANETs in terms of susceptibility owing to dispersed nature however these issues can be addressed by using optimization and deep learning techniques-based Intrusion Detection System (IDS). In this work, we develop a Binary Swarm Optimized Differential and Method of Moments Probabilistic Extreme Learning (BSOD-MMPEL) node behavior-based IDS for intrusion detection in MANET with minimum training time, misclassification and high precision, accuracy is proposed. Initially, network samples are collected from KDD-CUP-1999 dataset. To ensure robust and significant balance between exploration and exploitation with high probability of convergence to local sub-optima Gudermannian Activation Binary Swarm Optimized Differential Evolution-based Feature Selection is applied. Next, with the selected features, early detection of intrusion employing Method of Moments Probabilistic Extreme Learning Node Behavior-based IDS is designed. Simulations are performed to validate the result. The performance evaluation in terms of precision, accuracy, sensitivity, training time and misclassification rate show that the proposed method outperforms existing IDS in MANET. The proposed BSOD-MMPEL method is achieved to improve precision of 23 % and accuracy of 27 % and reduce training time of 62 % and misclassification rate of 68 % than existing conventional methods.

Multi-order feature interaction-aware intrusion detection scheme for ensuring cyber security of intelligent connected vehicles

The evolution of technology has raised concerns regarding cybersecurity for intelligent connected vehicles (ICVs). In-vehicle network in ICVs lacks robust protection mechanisms, making it vulnerable to cyber threats. In response, intrusion detection systems (IDSs) for ICVs have been developed to protect vehicles from malicious cyber attacks. However, current IDS methods solely rely on independent features, limiting their learning capabilities and increasing the number of false detections. Moreover, many IDSs require the knowledge of mapping between network messages and contents, which restricts their application. To address these limitations, we propose the Multi-order Feature Interaction-aware Intrusion Detection (MIFI) scheme for ICVs. Feature attention cross network is designed to address higher-order feature interactions, while factorization machine is used for second-order interactions. Then a discriminator is utilized to detect the attacks. MIFI expands the feature space through features interaction, thereby enhancing its ability to detect attacks. Moreover, it perceives the relationships of vehicle messages, facilitating intrusion detection without knowing the corresponding rules of vehicle messages. The performance of the proposed method is evaluated on two real-vehicle datasets, affirming its effectiveness and robustness. MIFI achieves an accuracy of over 99% in detecting different attacks. The proposed method can improve the accuracy of traditional IDS to a maximum of 99.99%, and increase the highest F1-score to 97.18%, demonstrating the model’s ability of achieving multi-order feature interactions. Ultimately, MIFI is suitable for intrusion detection in different types of ICV networks, significantly contributing to the cybersecurity of ICVs.

An Enhanced Hybrid Deep Learning Model to Enhance Network Intrusion Detection Capabilities for Cybersecurity

Recently, we have noticed tremendous growth in the field of Information Technology. This increased growth has proliferated the use of new technologies and continued advancement of networking systems. These systems are widely adopted for real-time online and offline tasks. Due to this growth in information technology, maintaining security has gained huge attention as these systems are vulnerable to various attacks. In this context, an Intrusion Detection System (IDS) plays an important role in ensuring security by detecting and preventing suspicious activities within the network. However, as technology is overgrowing, malicious activities are also increasing. Moreover, legacy IDS methods cannot handle new threats, such as traditional signature-based methods requiring a predefined rule set to detect malicious activity. Also, several new methods have been proposed earlier to address security-related issues; however, the performance of these methods is limited due to poor attack detection accuracy and increased false positive rates. In this work, we propose and compare different deep-learning (DL) models that can be used to construct IDSs to provide network security. Details on convolutional neural networks (CNNs), Multilayer Perceptron (MLP), and long short-term memories (LSTMs) are introduced. A discussion of the outcomes achieved follows an assessment of the proposed DL model known as the FOA-CNN-LSTM technique. Comparisons are made between the suggested models and other machine-learning methods. This work presents a deep-learning approach based on hybrid CNN-LSTM with Fruit fly Optimization Algorithm (FOA) by ensemble techniques to distinguish between normal and abnormal behaviors.

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset.

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID's frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets' attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding "raw" binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle's CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

Fed-Inforce-Fusion: A federated reinforcement-based fusion model for security and privacy protection of IoMT networks against cyber-attacks

Internet of Medical Things (IoMT) has emerged as a combination of sensors, healthcare devices, and Internet of Things (IoT) to deliver better and intelligent healthcare services. However, security and privacy protection issues have hindered its wide integration resulting in lack of quality IoMT dataset. Federated Learning (FL) is an emerging distributed learning method that can be helpful for IoMT networks and smart healthcare systems (SHS) due to enhanced security and privacy. The use of intrusion detection systems (IDS) has become vital for contemporary critical networks to protect against evolving cyber-attacks. Existing security models are often challenging and computationally expensive to apply to resource-limited medical IoT devices. To this end, this research work proposes a privacy-preserving FL-based IDS model named Fed-Inforce-Fusion to identify cyber-attacks from IoMT networks. Specifically, the proposed Fed-Inforce-Fusion model uses reinforcement learning technique to learn the latent relationships of medical data. Next, a FL-based system is designed allowing distributed SHS nodes to collaboratively train a comprehensive IDS model in a privacy preserving manner. Then, a fusion/aggregation strategy is adopted to improve the performance of detection model and reduce communication overhead by allowing participating clients to involve in the federation process dynamically. Theoretical study and experiment analysis show that the proposed Fed-Inforce-Fusion is better and effective in detecting complex attack vectors in comparison to existing benchmark IDS methods. Thus, proposing its efficacy and suitability in real-world IoMT networks.

IDS-EFS: Ensemble feature selection-based method for intrusion detection system

IDS-EFS: Ensemble feature selection-based method for intrusion detection system

A Big Data Analytical Framework for Intrusion Detection Based On Novel Elephant Herding Optimized Finite Dirichlet Mixture Models

For the purpose of identifying a wide variety of hostile activity in cyberspace, an Intrusion Detection System (IDS) is a crucial instrument. However, traditional IDSs have limitations in detecting zero-day attacks, which can lead to high false alarm rates. To address this issue, it is crucial to integrate the monitoring and analysis of network data with decision-making methods that can identify anomalous events accurately. By combining these approaches, organizations can develop more effective cybersecurity measures and better protect their networks from cyber threats. In this study, we proposed a novel called the Elephant Herding Optimized Finite Dirichlet Mixture Model (EHO-FDMM). This framework consists of three modules: capture and logging, pre-processing, and an innovative IDS method based on the EHO-FDMM. The NSL-KDD and UNSW-NB15 datasets are used to assess this framework's performance. The empirical findings show that selecting the optimum model that accurately fits the network data is aided by statistical analysis of the data. The EHO-FDMM-based intrusion detection method also offers a lower False Alarm Rate (FPR) and greater Detection Rate (DR) than the other three strong methods. The EHO-FDMM and exact interval of confidence bounds were used to create the suggested method's ability to detect even minute variations between legal and attack routes. These methods are based on correlations and proximity measurements, which are ineffective against contemporary assaults that imitate everyday actions.

Federated-SRUs: A Federated-Simple-Recurrent-Units-Based IDS for Accurate Detection of Cyber Attacks Against IoT-Augmented Industrial Control Systems

The security of Industrial Control Systems (ICS) against cyber-attacks is essential in modern era since ICSs are vital constituent of modern societies and smart cities. However, the augmentation of legacy ICS networks with smart computing and networking technologies (such as, IoT) have intensely enlarged the surface of attacks against these critical infrastructures. This augmentation makes these networks more vulnerable to cyber-attacks and despite the current security solutions, attackers still find ways to proliferate these networks. Intrusion Detection System (IDS) is one of the key security aspect to prevent these networks from contemporary cyber-attacks. Therefore, this paper proposes a new IDS model named Federated-SRUs (simple recurrent units) for the security of IoT-based ICSs. Specifically, the Federated-SRUs IDS model uses an improved simple recurrent units architecture to reduce computational cost and alleviate the gradient vanishing issue in recurrent networks. Then, it performs data aggregation through several communication rounds in federated architecture which allows multiple ICS networks and stakeholders to build a comprehensive IDS model in a privacy-preserving manner. The performance of Federated-SRUs IDS model is validated through experiments using real-world gas pipeline-based ICS network data, which indicates that it is able to accurately detect intrusions in real-time without compromising privacy and security. Experiments also verify that the Federated-SRUs model outperforms existing state-of-the-art approaches and thus can serve as a viable IDS method in IoT-based ICS networks.

Designing framework to secure data using K Means clustering based outlier Detection (KCOD) algorithm

The objective of the research work is to propose an intrusion detection system in a cloud environment using K-Means clustering-based outlier detection. In the open access and dispersed cloud architecture, the main problem is security and confidentiality because these are easily susceptible to intruders. Intrusion Detection System (IDS) is a commonly used method to identify the various attacks on the cloud which is easy to access from a remote area. The existing process can’t provide the data to transmit securely. This work describes and notifies the modernly established IDS and alarm management methods by giving probable responses to notice and inhibit the intrusions in the cloud computing environment and to overcome the security and privacy issue. Proposed K-means Clustering based Outlier Detection (KmCOD) is used to detect the intruders and efficiently secure the data from malicious activity, where it is formulated respectively to increase the trustworthiness of the system by using applying intrusion detection techniques to virtual machines thus keeping the system safe and free from intrusion also provides system reliability. The parametric measures such as the detection rate, trace preprocessing, and correctly identified and incorrectly identified malicious activity are chosen. The performance analysis shows the accuracy of outlier detection as 81%, detection rate achieves 76%, packet arrival rate reaches 79%, pre-processing trace achieves 74%, and malicious activity rate of 21%.

A Quantitative Logarithmic Transformation-Based Intrusion Detection System

Intrusion detection systems (IDS) play a vital role in protecting networks from malicious attacks. Modern IDS use machine-learning or deep-learning models to deal with the diversity of attacks that malicious users may employ. However, effective machine-learning methods incur a considerable cost in both the pretraining stage and the online detection process itself. Accordingly, this study proposes a quantitative logarithmic transformation-based intrusion detection system (QLT-IDS) that uses a straightforward statistical approach to analyze network behavior. Compared with machine-learning or deep-learning-based IDS methods, the proposed system requires neither a time-consuming and expensive data collection and training process, nor a GPU-included device to achieve a real-time detection performance. Furthermore, the system can deal not only with North-South attacks, but also East-West attacks, which pose a significant risk in real-world operations. The effectiveness of the proposed system is evaluated for both real-world campus network traffic and simulated traffic. The results confirm that QLT-IDS is able to detect a wide range of malicious attacks with a high precision, even under high down-sampling rate of the NetFlow records.

DDoS Attack Detection in Cloud Computing Based on Ensemble Feature Selection and Deep Learning

Intrusion Detection System (IDS) in the cloud Computing (CC) environment has received paramount interest over the last few years. Among the latest approaches, Deep Learning (DL)-based IDS methods allow the discovery of attacks with the highest performance. In the CC environment, Distributed Denial of Service (DDoS) attacks are widespread. The cloud services will be rendered unavailable to legitimate end-users as a consequence of the overwhelming network traffic, resulting in financial losses. Although various researchers have proposed many detection techniques, there are possible obstacles in terms of detection performance due to the use of insignificant traffic features. Therefore, in this paper, a hybrid deep learning mode based on hybridizing Convolutional Neural Network (CNN) with Long-Short-Term Memory (LSTM) is used due to its robustness and efficiency in detecting normal and attack traffic. Besides, the ensemble feature selection, mutualization aggregation between Particle Swarm Optimizer (PSO), Grey Wolf Optimizer (PSO), Krill Hird (KH), and Whale Optimization Algorithm (WOA), is used to select the most important features that would influence the detection performance in detecting DDoS attack in CC. A benchmark dataset proposed by the Canadian Institute of Cybersecurity (CIC), called CICIDS 2017 is used to evaluate the proposed IDS. The results revealed that the proposed IDS outperforms the state-of-the-art IDSs, as it achieved 97.9%, 98.3%, 97.9%, 98.1%, respectively. As a result, the proposed IDS achieves the requirements of getting high security, automatic, efficient, and self-decision detection of DDoS attacks.

Feature selection using PRACO method for IDS in cloud environment

Cloud Computing is the distribution of computing resources on demand to the users over Internet. But with virtual existence of data and resources comes the problem of privacy and security. In such environments Intrusion Detection System (IDS) comes in handy. They read huge chunks of data to find out attack patterns. But learning through this huge amount of data is very time consuming. So, data reduction is necessary. Using feature selection methods, number of features can be reduced by eliminating redundant and irrelevant attributes from datasets. In this paper the authors have proposed a Penalty Reward based Ant Colony Optimization (PRACO) method for feature selection. The penalty and reward terms used in this paper help in better exploration-exploitation trade-off by rewarding the useful features and penalizing the other ones. Along with that the concepts of max-relevance and min-redundancy are also used to indicate interactions between selected features. The proposed model is assessed on 10% KDD Cup 99, NSL-KDD and UNSW-NB15 datasets. It was observed that the PRACO method achieved 81.682% and 83.584% accuracy on average during train-test phase using NSL-KDD and UNSW-NB15 datasets. The results provide substantial evidence that the proposed model is effective in finding optimal results and thus provide IDS with increased efficiency.

Juggler-ResNet: A Flexible and High-Speed ResNet Optimization Method for Intrusion Detection System in Software-Defined Industrial Networks

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ResNets</i> are widely used in the intrusion detection system (IDS) of software-defined industrial network to construct accurate intelligence detection of network attacks. However, the IDS based on ResNets has a long detecting interval because of the fine-grained operator and intermediate outcomes of the multi-branch architecture of ResNets. To address this problem, in this article, we propose Juggler-ResNet with a fusible residual structure that preserves the feature extraction ability of the residual structure and enables equivalent transformation to linear topology to support low latency inference service in the industrial application (e.g., malicious network behavior detection, fault diagnosis, etc.). First, we propose a fusible multibranch residual structure to avoid gradient vanishing problems in the training phase. Second, we convert it to linear-topology by using a set of equivalent fusion operators. Finally, the linear-topology model is deployed to accelerate inference speed. Our experimental results on CIFAR-10 and CIFAR-100 show that fusible residual structure can achieve 2.08-4.3x acceleration with state-of-the-art level accuracy performance.

Implementation and Analysis of Combined Machine Learning Method for Intrusion Detection System

As one of the security components in Network Security Monitoring System, Intrusion Detection System (IDS) is implemented by many organizations in their networks to detect and address the impact of network attacks. There are many machine-learning methods that have been widely developed and applied in the IDS. Selection of appropriate methods is necessary to improve the detection accuracy in the application of machine-learning in IDS. In this research we proposed an IDS that we developed based on machine learning approach. We use 28 features subset without content features of Knowledge Data Discovery (KDD) dataset to build machine learning model. From our analysis and experiment we get 28 features subset of KDD dataset that are most likely to be applied for the IDS in the real network. The machine learning model based on this 28 features subset obtained 99.9% accuracy for both two-class and multiclass classification. From our experiments using the IDS we have developed show good performance in detecting attacks on real networks.

Classification and Explanation for Intrusion Detection System Based on Ensemble Trees and SHAP Method.

In recent years, many methods for intrusion detection systems (IDS) have been designed and developed in the research community, which have achieved a perfect detection rate using IDS datasets. Deep neural networks (DNNs) are representative examples applied widely in IDS. However, DNN models are becoming increasingly complex in model architectures with high resource computing in hardware requirements. In addition, it is difficult for humans to obtain explanations behind the decisions made by these DNN models using large IoT-based IDS datasets. Many proposed IDS methods have not been applied in practical deployments, because of the lack of explanation given to cybersecurity experts, to support them in terms of optimizing their decisions according to the judgments of the IDS models. This paper aims to enhance the attack detection performance of IDS with big IoT-based IDS datasets as well as provide explanations of machine learning (ML) model predictions. The proposed ML-based IDS method is based on the ensemble trees approach, including decision tree (DT) and random forest (RF) classifiers which do not require high computing resources for training models. In addition, two big datasets are used for the experimental evaluation of the proposed method, NF-BoT-IoT-v2, and NF-ToN-IoT-v2 (new versions of the original BoT-IoT and ToN-IoT datasets), through the feature set of the net flow meter. In addition, the IoTDS20 dataset is used for experiments. Furthermore, the SHapley additive exPlanations (SHAP) is applied to the eXplainable AI (XAI) methodology to explain and interpret the classification decisions of DT and RF models; this is not only effective in interpreting the final decision of the ensemble tree approach but also supports cybersecurity experts in quickly optimizing and evaluating the correctness of their judgments based on the explanations of the results.

An Ensemble Approach for Feature Selection and Classification in Intrusion Detection Using Extra-Tree Algorithm

The number of attacks increased with speedy development in web communication in the last couple of years. The Anomaly Detection method for IDS has become substantial in detecting novel attacks in Intrusion Detection System (IDS). Achieving high accuracy are the significant challenges in designing an intrusion detection system. It also emphasizes applying different feature selection techniques to identify the most suitable feature subset. The author uses Extremely randomized trees (Extra-Tree) for feature importance. The author tries multiple thresholds on the feature importance parameters to find the best features. If single classifiers use, then the classifier's output is wrong, so that the final decision may be wrong. So The author uses an Extra-Tree classifier applied to the best-selected features. The proposed method is estimated on standard datasets KDD CUP'99, NSL-KDD, and UNSW-NB15. The experimental results show that the proposed approach performs better than existing methods in detection rate, false alarm rate, and accuracy.