Intrusion Detection System Methods Research Articles

An Enhanced Hybrid Deep Learning Model to Enhance Network Intrusion Detection Capabilities for Cybersecurity

Recently, we have noticed tremendous growth in the field of Information Technology. This increased growth has proliferated the use of new technologies and continued advancement of networking systems. These systems are widely adopted for real-time online and offline tasks. Due to this growth in information technology, maintaining security has gained huge attention as these systems are vulnerable to various attacks. In this context, an Intrusion Detection System (IDS) plays an important role in ensuring security by detecting and preventing suspicious activities within the network. However, as technology is overgrowing, malicious activities are also increasing. Moreover, legacy IDS methods cannot handle new threats, such as traditional signature-based methods requiring a predefined rule set to detect malicious activity. Also, several new methods have been proposed earlier to address security-related issues; however, the performance of these methods is limited due to poor attack detection accuracy and increased false positive rates. In this work, we propose and compare different deep-learning (DL) models that can be used to construct IDSs to provide network security. Details on convolutional neural networks (CNNs), Multilayer Perceptron (MLP), and long short-term memories (LSTMs) are introduced. A discussion of the outcomes achieved follows an assessment of the proposed DL model known as the FOA-CNN-LSTM technique. Comparisons are made between the suggested models and other machine-learning methods. This work presents a deep-learning approach based on hybrid CNN-LSTM with Fruit fly Optimization Algorithm (FOA) by ensemble techniques to distinguish between normal and abnormal behaviors.

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset.

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID's frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets' attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding "raw" binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle's CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

Fed-Inforce-Fusion: A federated reinforcement-based fusion model for security and privacy protection of IoMT networks against cyber-attacks

Internet of Medical Things (IoMT) has emerged as a combination of sensors, healthcare devices, and Internet of Things (IoT) to deliver better and intelligent healthcare services. However, security and privacy protection issues have hindered its wide integration resulting in lack of quality IoMT dataset. Federated Learning (FL) is an emerging distributed learning method that can be helpful for IoMT networks and smart healthcare systems (SHS) due to enhanced security and privacy. The use of intrusion detection systems (IDS) has become vital for contemporary critical networks to protect against evolving cyber-attacks. Existing security models are often challenging and computationally expensive to apply to resource-limited medical IoT devices. To this end, this research work proposes a privacy-preserving FL-based IDS model named Fed-Inforce-Fusion to identify cyber-attacks from IoMT networks. Specifically, the proposed Fed-Inforce-Fusion model uses reinforcement learning technique to learn the latent relationships of medical data. Next, a FL-based system is designed allowing distributed SHS nodes to collaboratively train a comprehensive IDS model in a privacy preserving manner. Then, a fusion/aggregation strategy is adopted to improve the performance of detection model and reduce communication overhead by allowing participating clients to involve in the federation process dynamically. Theoretical study and experiment analysis show that the proposed Fed-Inforce-Fusion is better and effective in detecting complex attack vectors in comparison to existing benchmark IDS methods. Thus, proposing its efficacy and suitability in real-world IoMT networks.

IDS-EFS: Ensemble feature selection-based method for intrusion detection system

IDS-EFS: Ensemble feature selection-based method for intrusion detection system

A Big Data Analytical Framework for Intrusion Detection Based On Novel Elephant Herding Optimized Finite Dirichlet Mixture Models

For the purpose of identifying a wide variety of hostile activity in cyberspace, an Intrusion Detection System (IDS) is a crucial instrument. However, traditional IDSs have limitations in detecting zero-day attacks, which can lead to high false alarm rates. To address this issue, it is crucial to integrate the monitoring and analysis of network data with decision-making methods that can identify anomalous events accurately. By combining these approaches, organizations can develop more effective cybersecurity measures and better protect their networks from cyber threats. In this study, we proposed a novel called the Elephant Herding Optimized Finite Dirichlet Mixture Model (EHO-FDMM). This framework consists of three modules: capture and logging, pre-processing, and an innovative IDS method based on the EHO-FDMM. The NSL-KDD and UNSW-NB15 datasets are used to assess this framework's performance. The empirical findings show that selecting the optimum model that accurately fits the network data is aided by statistical analysis of the data. The EHO-FDMM-based intrusion detection method also offers a lower False Alarm Rate (FPR) and greater Detection Rate (DR) than the other three strong methods. The EHO-FDMM and exact interval of confidence bounds were used to create the suggested method's ability to detect even minute variations between legal and attack routes. These methods are based on correlations and proximity measurements, which are ineffective against contemporary assaults that imitate everyday actions.

Federated-SRUs: A Federated-Simple-Recurrent-Units-Based IDS for Accurate Detection of Cyber Attacks Against IoT-Augmented Industrial Control Systems

The security of Industrial Control Systems (ICS) against cyber-attacks is essential in modern era since ICSs are vital constituent of modern societies and smart cities. However, the augmentation of legacy ICS networks with smart computing and networking technologies (such as, IoT) have intensely enlarged the surface of attacks against these critical infrastructures. This augmentation makes these networks more vulnerable to cyber-attacks and despite the current security solutions, attackers still find ways to proliferate these networks. Intrusion Detection System (IDS) is one of the key security aspect to prevent these networks from contemporary cyber-attacks. Therefore, this paper proposes a new IDS model named Federated-SRUs (simple recurrent units) for the security of IoT-based ICSs. Specifically, the Federated-SRUs IDS model uses an improved simple recurrent units architecture to reduce computational cost and alleviate the gradient vanishing issue in recurrent networks. Then, it performs data aggregation through several communication rounds in federated architecture which allows multiple ICS networks and stakeholders to build a comprehensive IDS model in a privacy-preserving manner. The performance of Federated-SRUs IDS model is validated through experiments using real-world gas pipeline-based ICS network data, which indicates that it is able to accurately detect intrusions in real-time without compromising privacy and security. Experiments also verify that the Federated-SRUs model outperforms existing state-of-the-art approaches and thus can serve as a viable IDS method in IoT-based ICS networks.

Designing framework to secure data using K Means clustering based outlier Detection (KCOD) algorithm

The objective of the research work is to propose an intrusion detection system in a cloud environment using K-Means clustering-based outlier detection. In the open access and dispersed cloud architecture, the main problem is security and confidentiality because these are easily susceptible to intruders. Intrusion Detection System (IDS) is a commonly used method to identify the various attacks on the cloud which is easy to access from a remote area. The existing process can’t provide the data to transmit securely. This work describes and notifies the modernly established IDS and alarm management methods by giving probable responses to notice and inhibit the intrusions in the cloud computing environment and to overcome the security and privacy issue. Proposed K-means Clustering based Outlier Detection (KmCOD) is used to detect the intruders and efficiently secure the data from malicious activity, where it is formulated respectively to increase the trustworthiness of the system by using applying intrusion detection techniques to virtual machines thus keeping the system safe and free from intrusion also provides system reliability. The parametric measures such as the detection rate, trace preprocessing, and correctly identified and incorrectly identified malicious activity are chosen. The performance analysis shows the accuracy of outlier detection as 81%, detection rate achieves 76%, packet arrival rate reaches 79%, pre-processing trace achieves 74%, and malicious activity rate of 21%.

A Quantitative Logarithmic Transformation-Based Intrusion Detection System

Intrusion detection systems (IDS) play a vital role in protecting networks from malicious attacks. Modern IDS use machine-learning or deep-learning models to deal with the diversity of attacks that malicious users may employ. However, effective machine-learning methods incur a considerable cost in both the pretraining stage and the online detection process itself. Accordingly, this study proposes a quantitative logarithmic transformation-based intrusion detection system (QLT-IDS) that uses a straightforward statistical approach to analyze network behavior. Compared with machine-learning or deep-learning-based IDS methods, the proposed system requires neither a time-consuming and expensive data collection and training process, nor a GPU-included device to achieve a real-time detection performance. Furthermore, the system can deal not only with North-South attacks, but also East-West attacks, which pose a significant risk in real-world operations. The effectiveness of the proposed system is evaluated for both real-world campus network traffic and simulated traffic. The results confirm that QLT-IDS is able to detect a wide range of malicious attacks with a high precision, even under high down-sampling rate of the NetFlow records.

DDoS Attack Detection in Cloud Computing Based on Ensemble Feature Selection and Deep Learning

Intrusion Detection System (IDS) in the cloud Computing (CC) environment has received paramount interest over the last few years. Among the latest approaches, Deep Learning (DL)-based IDS methods allow the discovery of attacks with the highest performance. In the CC environment, Distributed Denial of Service (DDoS) attacks are widespread. The cloud services will be rendered unavailable to legitimate end-users as a consequence of the overwhelming network traffic, resulting in financial losses. Although various researchers have proposed many detection techniques, there are possible obstacles in terms of detection performance due to the use of insignificant traffic features. Therefore, in this paper, a hybrid deep learning mode based on hybridizing Convolutional Neural Network (CNN) with Long-Short-Term Memory (LSTM) is used due to its robustness and efficiency in detecting normal and attack traffic. Besides, the ensemble feature selection, mutualization aggregation between Particle Swarm Optimizer (PSO), Grey Wolf Optimizer (PSO), Krill Hird (KH), and Whale Optimization Algorithm (WOA), is used to select the most important features that would influence the detection performance in detecting DDoS attack in CC. A benchmark dataset proposed by the Canadian Institute of Cybersecurity (CIC), called CICIDS 2017 is used to evaluate the proposed IDS. The results revealed that the proposed IDS outperforms the state-of-the-art IDSs, as it achieved 97.9%, 98.3%, 97.9%, 98.1%, respectively. As a result, the proposed IDS achieves the requirements of getting high security, automatic, efficient, and self-decision detection of DDoS attacks.

Feature selection using PRACO method for IDS in cloud environment

Cloud Computing is the distribution of computing resources on demand to the users over Internet. But with virtual existence of data and resources comes the problem of privacy and security. In such environments Intrusion Detection System (IDS) comes in handy. They read huge chunks of data to find out attack patterns. But learning through this huge amount of data is very time consuming. So, data reduction is necessary. Using feature selection methods, number of features can be reduced by eliminating redundant and irrelevant attributes from datasets. In this paper the authors have proposed a Penalty Reward based Ant Colony Optimization (PRACO) method for feature selection. The penalty and reward terms used in this paper help in better exploration-exploitation trade-off by rewarding the useful features and penalizing the other ones. Along with that the concepts of max-relevance and min-redundancy are also used to indicate interactions between selected features. The proposed model is assessed on 10% KDD Cup 99, NSL-KDD and UNSW-NB15 datasets. It was observed that the PRACO method achieved 81.682% and 83.584% accuracy on average during train-test phase using NSL-KDD and UNSW-NB15 datasets. The results provide substantial evidence that the proposed model is effective in finding optimal results and thus provide IDS with increased efficiency.

Juggler-ResNet: A Flexible and High-Speed ResNet Optimization Method for Intrusion Detection System in Software-Defined Industrial Networks

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ResNets</i> are widely used in the intrusion detection system (IDS) of software-defined industrial network to construct accurate intelligence detection of network attacks. However, the IDS based on ResNets has a long detecting interval because of the fine-grained operator and intermediate outcomes of the multi-branch architecture of ResNets. To address this problem, in this article, we propose Juggler-ResNet with a fusible residual structure that preserves the feature extraction ability of the residual structure and enables equivalent transformation to linear topology to support low latency inference service in the industrial application (e.g., malicious network behavior detection, fault diagnosis, etc.). First, we propose a fusible multibranch residual structure to avoid gradient vanishing problems in the training phase. Second, we convert it to linear-topology by using a set of equivalent fusion operators. Finally, the linear-topology model is deployed to accelerate inference speed. Our experimental results on CIFAR-10 and CIFAR-100 show that fusible residual structure can achieve 2.08-4.3x acceleration with state-of-the-art level accuracy performance.

Implementation and Analysis of Combined Machine Learning Method for Intrusion Detection System

As one of the security components in Network Security Monitoring System, Intrusion Detection System (IDS) is implemented by many organizations in their networks to detect and address the impact of network attacks. There are many machine-learning methods that have been widely developed and applied in the IDS. Selection of appropriate methods is necessary to improve the detection accuracy in the application of machine-learning in IDS. In this research we proposed an IDS that we developed based on machine learning approach. We use 28 features subset without content features of Knowledge Data Discovery (KDD) dataset to build machine learning model. From our analysis and experiment we get 28 features subset of KDD dataset that are most likely to be applied for the IDS in the real network. The machine learning model based on this 28 features subset obtained 99.9% accuracy for both two-class and multiclass classification. From our experiments using the IDS we have developed show good performance in detecting attacks on real networks.

Classification and Explanation for Intrusion Detection System Based on Ensemble Trees and SHAP Method.

In recent years, many methods for intrusion detection systems (IDS) have been designed and developed in the research community, which have achieved a perfect detection rate using IDS datasets. Deep neural networks (DNNs) are representative examples applied widely in IDS. However, DNN models are becoming increasingly complex in model architectures with high resource computing in hardware requirements. In addition, it is difficult for humans to obtain explanations behind the decisions made by these DNN models using large IoT-based IDS datasets. Many proposed IDS methods have not been applied in practical deployments, because of the lack of explanation given to cybersecurity experts, to support them in terms of optimizing their decisions according to the judgments of the IDS models. This paper aims to enhance the attack detection performance of IDS with big IoT-based IDS datasets as well as provide explanations of machine learning (ML) model predictions. The proposed ML-based IDS method is based on the ensemble trees approach, including decision tree (DT) and random forest (RF) classifiers which do not require high computing resources for training models. In addition, two big datasets are used for the experimental evaluation of the proposed method, NF-BoT-IoT-v2, and NF-ToN-IoT-v2 (new versions of the original BoT-IoT and ToN-IoT datasets), through the feature set of the net flow meter. In addition, the IoTDS20 dataset is used for experiments. Furthermore, the SHapley additive exPlanations (SHAP) is applied to the eXplainable AI (XAI) methodology to explain and interpret the classification decisions of DT and RF models; this is not only effective in interpreting the final decision of the ensemble tree approach but also supports cybersecurity experts in quickly optimizing and evaluating the correctness of their judgments based on the explanations of the results.

An Ensemble Approach for Feature Selection and Classification in Intrusion Detection Using Extra-Tree Algorithm

The number of attacks increased with speedy development in web communication in the last couple of years. The Anomaly Detection method for IDS has become substantial in detecting novel attacks in Intrusion Detection System (IDS). Achieving high accuracy are the significant challenges in designing an intrusion detection system. It also emphasizes applying different feature selection techniques to identify the most suitable feature subset. The author uses Extremely randomized trees (Extra-Tree) for feature importance. The author tries multiple thresholds on the feature importance parameters to find the best features. If single classifiers use, then the classifier's output is wrong, so that the final decision may be wrong. So The author uses an Extra-Tree classifier applied to the best-selected features. The proposed method is estimated on standard datasets KDD CUP'99, NSL-KDD, and UNSW-NB15. The experimental results show that the proposed approach performs better than existing methods in detection rate, false alarm rate, and accuracy.

Unified Deep Learning approach for Efficient Intrusion Detection System using Integrated Spatial–Temporal Features

Intrusion detection systems (IDS) differentiate the malicious entries from the legitimate entries in network traffic data and helps in securing the networks. Deep learning algorithms have been greatly employed in the network security field for large scale data in modern cyberspace networks because of their ability to learn the deeply integrated features. However, learning both space and time aspects of system information are very challenging for any individual deep knowledge model. While Convolutional Neural Networks (CNN) effectively acquires the spatial aspects, the Long Short-Term Memory (LSTM) neural networks perform better for temporal features. Integrating the benefits of these models has the potential for improving the large scale IDS. In this paper, a high accurate IDS model is proposed by using a unified model of Optimized CNN (OCNN) and Hierarchical Multi-scale LSTM (HMLSTM) for effective extraction and learning of spatial–temporal features. The proposed IDS model performs the pre-processing, feature extraction through network training and network testing and final classification. In the OCNN–HMLSTM model, the Lion Swarm Optimization (LSO) is used to tune the hyper-parameters of CNN for the optimal configuration of learning spatial features. The HMLSTM learns the hierarchical relationships between the different features and extracts the time features. Lastly, the unified IDS approach utilizes the extracted spatial–temporal features for categorizing the network data. Tests are performed over public IDS datasets namely NSL-KDD, ISCX-IDS and UNSWNB15. Assessing the performance of OCNN–HMLSTM​ against the contemporary IDS methods, the proposed model performs better intrusion detection with high accuracy of above 90% with less false values and better classification coefficients.

An Optimal Decision Method for Intrusion Detection System in Wireless Sensor Networks With Enhanced Cooperation Mechanism

When it comes to selecting an optimal defense strategy for an intrusion detection system of a wireless sensor network, such challenges as those brought about by the diversification of the attack methods and the expanded database of the attack patterns have to be dealt with. To overcome those challenges, this paper combines realistic bounded rationality with the incomplete information of the attack-defense players by employing evolutionary game theory as a tool. Firstly, an attack-defense evolutionary game model considering three types of population, in which attackers are subdivided by the source of the threat into external attackers and selfish nodes, is proposed. The sets of player types and the game strategies in our model can be extended from 2×2 to n× m × l. The sensitivity of the evolutionary population to similar strategies, which reflects the efficiency change in the multi-agent learning process, is depicted by a replicator dynamic equation especially optimized for this purpose by the introduction of an enhanced cooperation mechanism. In essence, an optimal defense strategy selection algorithm is provided by calculating the evolutionary stable equilibrium and a description of the evolutionary trajectory of the players over time is obtained. Moderate security and proactive defense in the form of support decisions have been provided by our method for wireless sensor networks. Experimental results have verified the validity of our method. Moreover, the optimized algorithm has solved the problem that an excessively large database of attack patterns affects the speed of switching to the optimal defense decision strategy and the learning efficiency of the evolutionary game replicator dynamic mechanism is not fast enough.

Detecting Generic Network Intrusion Attacks using Tree-based Machine Learning Methods

The development Intrusion Detection System (IDS) has a solid impact in mitigating against internal and external cyber threats among other cybersecurity methods. The machine learning-based method for IDS has proven to be an effective approach to detecting either anomaly or multiple classes of intrusion. For the detection of various types of intrusion by a single IDS model, it is discovered that the overall high accuracy of the IDS model does not translate to high accuracy for each attack type. Some intrusion attacks are seen to share similarities with other attacks thereby evading detection, one of which is the generic attack. The notoriety of the generic attack is the ability of a single generic attack to compromise a whole bunch of block-ciphers. Therefore, this study proposed a machine learning framework to specifically detect generic network intrusion by implementing two (2) decision tree algorithms. The decision tree methods were developed using two distinct variants namely the J48 and Random Tree algorithms. A balanced generic network dataset was curated and used for model development. A 10-fold cross-validation technique was implemented for model development and performance evaluation, where all obtainable performance scores were extracted and presented. The performances of the decision tree methods for generic network intrusion attack detection were comparative analysis and also evaluated against existing methods. The proposed methods of this study are robust, stable and empirically seen to have outperformed existing methods.

Intrusion Detection System Using FKNN and Improved PSO

Intrusion detection system (IDS) techniques are used in cybersecurity to protect and safeguard sensitive assets. The increasing network security risks can be mitigated by implementing effective IDS methods as a defense mechanism. The proposed research presents an IDS model based on the methodology of the adaptive fuzzy k-nearest neighbor (FKNN) algorithm. Using this method, two parameters, i.e., the neighborhood size (k) and fuzzy strength parameter (m) were characterized by implementing the particle swarm optimization (PSO). In addition to being used for FKNN parametric optimization, PSO is also used for selecting the conditional feature subsets for detection. To proficiently regulate the indigenous and comprehensive search skill of the PSO approach, two control parameters containing the time-varying inertia weight (TVIW) and time-varying acceleration coefficients (TVAC) were applied to the system. In addition, continuous and binary PSO algorithms were both executed on a multi-core platform. The proposed IDS model was compared with other state-of-the-art classifiers. The results of the proposed methodology are superior to the rest of the techniques in terms of the classification accuracy, precision, recall, and f-score. The results showed that the proposed methods gave the highest performance scores compared to the other conventional algorithms in detecting all the attack types in two datasets. Moreover, the proposed method was able to obtain a large number of true positives and negatives, with minimal number of false positives and negatives.

Analisis Serangan DDoS Menggunakan Metode Jaringan Saraf Tiruan

DDoS attack (Distribute Denial of Service) is one of the weapons of choice from hackers because it’s proven it has become threat on the internet worlds. The frequent of DDoS attacks creates a threat to internet users or servers, so that requires the introduction of several new methods that occur, one of which can use the IDS (Intrusion Detection System) method. This study took advantage of Neural Network ability to detect DDoS attack or normal based on traffic log processed statistically using Fixed Moving Window. The DDOS attack scheme uses a network topology that has been designed based on the needs and objectives that are found in monitoring network traffic. In each DDoS data and normal consist of 27 traffic log with total numbers of dataset as much as 54 data along with each testing data as much as 10 DDoS data and normal. Data collection was performed using LOIC, HOIC, and DoSHTTP with 300 seconds of traffic monitoring. The result of the Fixed Moving Window processing is the extraction value that will be put in the Neural Networks have 6 input values, one hidden layer with 300 neurons and 2 outputs which consist of a normal dataset and a DDoS dataset. The results of this study showed that Neural Network can detect DDoS and Normal in a good way with accuracy value as much as 95%.