Network Intrusion Detection Method Research Articles

A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things

The purpose of a network intrusion detection (NID) is to detect intrusions in the network, which plays a critical role in ensuring the security of the Internet of Things (IoT). Recently, deep learning (DL) has achieved a great success in the field of intrusion detection. However, the limited computing capabilities and storage of IoT devices hinder the actual deployment of DL-based high-complexity models. In this article, we propose a novel NID method for IoT based on the lightweight deep neural network (LNN). In the data preprocessing stage, to avoid high-dimensional raw traffic features leading to high model complexity, we use the principal component analysis (PCA) algorithm to achieve feature dimensionality reduction. Besides, our classifier uses the expansion and compression structure, the inverse residual structure, and the channel shuffle operation to achieve effective feature extraction with low computational cost. For the multiclassification task, we adopt the NID loss that acts as a better loss function to replace the standard cross-entropy loss for dealing with the problem of uneven distribution of samples. The results of experiments on two real-world NID data sets demonstrate that our method has excellent classification performance with low model complexity and small model size, and it is suitable for classifying the IoT traffic of normal and attack scenarios.

Network Intrusion Detection Method Based on Improved CNN in Internet of Things Environment

In view of most existing intrusion detection technologies that cannot meet the actual needs of the Internet of Things and facing the problems of poor detection effect of complex network intrusion methods, a network intrusion detection method based on deep learning algorithm in the environment of the Internet of Things is proposed. Firstly, the Internet of Things intrusion detection model is constructed based on edge computing, in which the concept of gated convolution is introduced to improve the convolution neural network model. Data passes through convolution layer, pooling, dropout, full connection, and Softmax function to realize multiclassification. Finally, the Focal Loss function is used to modulate the training ratio of positive and negative samples to solve the problem of uneven distribution of sample data. The proposed algorithm is demonstrated experimentally based on KDD99 data set. The results show that the accuracy, precision, recall, and F1 values are 92.14%, 95.97%, 90.89%, and 90.03%, which are better than other comparison algorithms. The proposed method can better meet the needs of Internet of Things intrusion detection.

Jasmine: A new Active Learning approach to combat cybercrime

One of the reasons that the deployment of network intrusion detection methods falls short is the lack of realistic labeled datasets, which makes it challenging to develop and compare techniques. It is caused by the large amounts of effort that it takes for a cyber expert to classify network connections. This has raised the need for methods that learn from both labeled and unlabeled data which observations are best to present to the human expert. Hence, Active Learning (AL) methods are of interest.In this paper, we propose a new hybrid AL method called Jasmine. Firstly, it uses the uncertainty score and anomaly score to determine how suitable each observation is for querying, i.e., how likely it is to enhance classification. Secondly, Jasmine introduces dynamic updating. This allows the model to adjust the balance between querying uncertain, anomalous and randomly selected observations. To this end, Jasmine is able to learn the best query strategy during the labeling process. This is in contrast to the other AL methods in cybersecurity that all have static, predetermined query functions. We show that dynamic updating, and therefore Jasmine, is able to consistently obtain good and more robust results than querying only uncertainties, only anomalies or a fixed combination of the two.

Network Intrusion Detection Method Combining CNN and BiLSTM in Cloud Computing Environment.

A network intrusion detection method combining CNN and BiLSTM network is proposed. First, the KDD CUP 99 data set is preprocessed by using data extraction algorithm. The data set is transformed into image data set by data cleaning, data extraction, and data mapping; Second, CNN is used to extract the parallel local features of attribute information, and BiLSTM is used to extract the features of long-distance-dependent information, so as to fully consider the influence between the front and back attribute information, and attention mechanism is introduced to improve the classification accuracy. Finally, C5.0 decision tree and CNN BiLSTM deep learning model are combined to skip the design feature selection and directly use deep learning model to learn the representational features of high-dimensional data. Experimental results show that, compared with the methods based on AE-AlexNet and SGM-CNN, the network intrusion detection effect of this method is better, the average accuracy can be improved to 95.50%, the false-positive rate can be reduced to 4.24%, and the false positive rate can be reduced to 6.66%. The proposed method can significantly improve the performance of network intrusion detection system.

Network intrusion detection using ACO-DNN model with DVFS based energy optimization in cloud framework

Recent technologies and innovations have encouraged users to adopt cloud-based environment. Network intrusion detection (NID) is an important method for network system administrators to detect various security holes. The performance of traditional NID methods can be affected when unknown or new attacks are detected. For instance, existing intrusion detection systems may have overfitting, low classification accuracy, and high false positive rate (FPR) when faced with significantly large volume and variety of network data. For that reason, this system has been agreed by many establishments to allure the users with its suitable features. Because of its design, it is exposed to malicious attacks. An Intrusion Detection System (IDS) is required to handle these issues which can detect such attacks accurately in a cloud environment. To analyze the IDS datasets some of the predominant choices are Deep learning and Machine learning (ML) algorithms. By adopting nature-inspired algorithms, the problems concerning the data quality and the usage of high-dimensional data can be managed. In this study the datasets KDD Cup 99 and NSL-KDD are used. The dataset is cleaned using the min-max normalization technique and it is processed using the 1-N encoding approach for achieving homogeneity. Dimensionality reduction is done using the Ant colony optimization (ACO) algorithm and further processing is done using the deep neural network (DNN). To minimize the energy consumption we have adopted the Dynamic Voltage and Frequency Scaling (DVFS) mechanism to the system. The main reason to set up this concept is to develop a balance between the energy consumption and the time of different modes of VMs or hosts. The proposed model is validated and compared with ACO and Principal component analysis (PCA)-based (Naïve Bayes) NB models, the experimental outcomes proved the superiority of the ACO-DNN model over the existing methods.

Network Intrusion Detection Method Based on FCWGAN and BiLSTM.

Imbalanced datasets greatly affect the analysis capability of intrusion detection models, biasing their classification results toward normal behavior and leading to high false-positive and false-negative rates. To alleviate the impact of class imbalance on the detection accuracy of network intrusion detection models and improve their effectiveness, this paper proposes a method based on a feature selection-conditional Wasserstein generative adversarial network (FCWGAN) and bidirectional long short-term memory network (BiLSTM). The method uses the XGBoost algorithm with Spearman's correlation coefficient to select the data features, filters out useless and redundant features, and simplifies the data structure. A conditional WGAN (CWGAN) is used to generate a small number of samples in the dataset, add them to the original training set to supplement the dataset samples, and apply BiLSTM to complete the training of the model and realize the classification. In comparative tests based on the NSL-KDD and UNSW-NB15 datasets, the accuracy of the proposed model reached 99.57% and 85.59%, respectively, which is 1.44% and 2.98% higher than that of the same type of CWGAN and deep neural network (CWGAN-DNN) model, respectively.

Deep Q-Learning Based Reinforcement Learning Approach for Network Intrusion Detection

The rise of the new generation of cyber threats demands more sophisticated and intelligent cyber defense solutions equipped with autonomous agents capable of learning to make decisions without the knowledge of human experts. Several reinforcement learning methods (e.g., Markov) for automated network intrusion tasks have been proposed in recent years. In this paper, we introduce a new generation of the network intrusion detection method, which combines a Q-learning based reinforcement learning with a deep feed forward neural network method for network intrusion detection. Our proposed Deep Q-Learning (DQL) model provides an ongoing auto-learning capability for a network environment that can detect different types of network intrusions using an automated trial-error approach and continuously enhance its detection capabilities. We provide the details of fine-tuning different hyperparameters involved in the DQL model for more effective self-learning. According to our extensive experimental results based on the NSL-KDD dataset, we confirm that the lower discount factor, which is set as 0.001 under 250 episodes of training, yields the best performance results. Our experimental results also show that our proposed DQL is highly effective in detecting different intrusion classes and outperforms other similar machine learning approaches.

A Variational Information Bottleneck Method for Network Intrusion Detection

The increasing application of machine learning to network intrusion detection has shown great successes in the recent years. To reduce the high dimension of captured network records for classifiers to learn efficiently, various feature reduction methods have been proposed. Using the Information Bottleneck framework, a concise and discriminative feature representation can be derived by optimizing an intuition and theoretically grounded objective function. In this paper, we propose a novel Variational Information Bottleneck method for Network Intrusion Detection that can produce high-quality low-dimensional representation to increase the classification accuracy of conventional machine learning classifier. Moreover, the proposed model is shown to achieve promising accuracy scores in comparison to several state-of-the-art anomaly-based IDS, on both the 2-class classification and 5-class classification intrusion detection problem.

Network intrusion detection method based on improved ant colony algorithm combined with cluster analysis in cloud computing environment

Network intrusion detection method based on improved ant colony algorithm combined with cluster analysis in cloud computing environment

Network intrusion detection method based on improved ant colony algorithm combined with cluster analysis in cloud computing environment

Network intrusion detection method based on improved ant colony algorithm combined with cluster analysis in cloud computing environment

Research on intrusion detection method based on SMOTE and DBN-LSSVM

Aiming at the problems of low accuracy and high false alarm rate when traditional machine learning algorithm processes massive and complex intrusion detection data, this paper proposes a network intrusion detection method (SMOTE-DBN-LSSVM) which combines deep belief network (DBN), synthetic minority oversampling technique (SMOTE) and least squares support vector machine (LSSVM). In this algorithm, intrusion detection data is input to the DBN for depth feature extraction, and then a small number of samples are added through SMOTE algorithm. Finally, LSSVM is used for classification. Through the effective evaluation of SMOTE-DBN-LSSVM model by NSL-KDD dataset, the experimental results show that SMOTE-DBN-LSSVM algorithm has the advantages of high accuracy and low false alarm rate compared with other algorithms, and improves the detection rate of small sample attacks.

The Method of Network Intrusion Detection Based on Descriptive Statistics Model and Logistic Model

In order to improve the efficiency of network intrusion detection, we want to find simpler models and detection rules, so we research the network intrusion detection with the descriptive statistics model and Logistic model. We pay attention to the features law about discrete distribution and concentrated distribution, and answer the question, which is better of relative optimal results between the descriptive statistics model and Logistic model. Firstly, for finding the features law about discrete distribution and concentrated distribution, we analysis the netflows with every feature. In this situation, the satisfactory accuracy can be given. Secondly, considering the redundant information with principal component analysis, the principal components are used as new variables to establish the logistic model. Using confusion matrix and ROC curve, the optimal cutting value and the corresponding accuracy can be obtained. Finally, by the experiments and evaluation with dataset CIC-IDS2017, the descriptive statistics model is the optimal model, which the corresponding accuracy rate is 99.93%.

A federated learning method for network intrusion detection

AbstractIntrusion detection is a common network security defense technology. At present, there are many research using deep learning to realize network intrusion detection. This method has been proved to have high detection accuracy. However, deep learning requires large‐scale data sets for training. The network intrusion detection data set of some institution is lacking. If the network traffic data set is uploaded for centralized deep learning training, it will face privacy problems. Combined with the characteristics of network traffic, this article proposes a network intrusion detection method based on federated learning. This method allows multiple ISPs or other institutions to conduct joint deep learning training on the premise of retaining local data. It not only improves the detection accuracy of the model but also protects privacy in network traffic. This article conducts experiments on the CICIDS2017 network intrusion detection data set. Experimental results show that worker participating in federated learning have higher detection accuracy. The accuracy and other performance of federated learning are almost equal to those of centralized deep learning models.

Big Data Analysis and Management of Healthcare Systems for Hacker Detection Based on Google Net Convolutional Neural Network

In recent times, Hacking has turn out to be more unfavorable than ever in all life fields, including the healthcare systems, with an increasing usage of information technology. By the expansion of technology development, the attacks number is too rising every few months in an exponential manner, which in turn makes the conventional IDS incapable to perceive. A healthcare system network intrusion detection method is proposed depending on the Google NET convolution neural network (Google NET). In healthcare system databases, intrusion detection (KDDs) can be seen as a search issue, which might be solved with the use of Google NET CNN algorithms. After pre-processing and characterizing the healthcare system data (including Electronic Health Records (EHR), Medical imaging data, Electronic Medical Records (EMR), etc.), the Google NET CNN model is used to simulate the intrusion into the healthcare system data. The low-level data intrusion is signified conceptually as the superior features with Google NET CNN, which in turn extracts the sample features separately, and by using MFO, network parameter is optimized (algorithm of optimization to meet the representation. At last, a sample test is conducted for the detection of healthcare system network intrusion behavior. The simulation outcome illustrate that the proposed technique has high accuracy on detection and a lower false-positive rate along with true positive rate.

Intrusion Detection Using Few-shot Learning Based on Triplet Graph Convolutional Network

Machine learning and deep learning methods have been widely used in network intrusion detection, most of which are supervised intrusion detection methods, which need to train a lot of marked data. However, in some cases, a small amount of exception data is hidden in a large amount of exception data, making methods that require a large amount of the same markup data to learn features invalid. In order to solve this problem, this paper proposes an innovative method of small sample network intrusion detection. The innovation point is that network data is modeled as graph structure to effectively mine the correlation features between data samples, and by comparing the distance similarity, the triplet network structure is used to detect anomalies. The triplet network is composed of triplet graph convolutional neural network which shares the same parameters and is trained by providing triplet samples to the network. Experiments on network traffic datasets CSE-CIC-IDS2018 and UNSW-NB15 as well as system status monitoring datasets verify the effectiveness of the proposed method in network intrusion detection of small samples.

Network intrusion detection method based on deep learning

With the rapid development of the network, network transmission encryption technologies such as SSL and SSH have emerged. Network traffic has grown exponentially, and transmission encryption has become an important means of protecting data security and privacy. However, encrypted data also brings hidden dangers that are not easily detectable to network security. Identifying the encrypted network traffic can effectively solve this problem. However, the current recognition probability is not high enough and the time delay caused by the recognition together makes it impossible to accurately detect and warn the network traffic. An encrypted network traffic recognition method based on deep learning is proposed. Experimental verification shows that the method is applied in the network. The accuracy of encrypted network traffic identification is 97.02%, which can meet actual needs.

Research on Network Intrusion Detection Method Based on Deep Learning Algorithm

Information security is very important in enterprises. Under the tide of modern network informationization, especially intrusion detection is facing great challenges. The rise of technologies such as big data and artificial intelligence, on the one hand, helps to strengthen information security, on the other hand, it also brings great challenges to information security. Everything has two sides, and the Internet is no exception. While the network has brought us a richer and faster life, the problem of network security has become increasingly prominent, and network security risks pose new challenges to the fields of politics, economy, culture, national defense, ecology and society. The active defense strategy using intrusion detection technology can actively discover attacks when they occur or attempt to attack, realize real-time response, and provide real-time protection for network systems. This paper starts from the field of intrusion detection and combines deep learning technology to design an efficient and intelligent intrusion detection model which can be used in the field of network intrusion detection.

CBAM: A Contextual Model for Network Anomaly Detection

Anomaly-based intrusion detection methods aim to combat the increasing rate of zero-day attacks, however, their success is currently restricted to the detection of high-volume attacks using aggregated traffic features. Recent evaluations show that the current anomaly-based network intrusion detection methods fail to reliably detect remote access attacks. These are smaller in volume and often only stand out when compared to their surroundings. Currently, anomaly methods try to detect access attack events mainly as point anomalies and neglect the context they appear in. We present and examine a contextual bidirectional anomaly model (CBAM) based on deep LSTM-networks that is specifically designed to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities. Access attacks frequently break these patterns when exploiting vulnerabilities, and can thus be detected as contextual anomalies. We evaluated CBAM on an assembly of three datasets that provide both representative network access attacks, real-life traffic over a long timespan, and traffic from a real-world red-team attack. We contend that this assembly is closer to a potential deployment environment than current NIDS benchmark datasets. We show that, by building a deep model, we are able to reduce the false positive rate to 0.16% while effectively detecting six out of seven access attacks, which is significantly lower than the operational range of other methods. We further demonstrate that short-term flow structures remain stable over long periods of time, making the CBAM robust against concept drift.

UAV network intrusion detection method based on spatio-temporal graph convolutional network

UAV network intrusion detection method based on spatio-temporal graph convolutional network

An Efficient Intrusion Detection Method Based on Dynamic Autoencoder

The proliferation of wireless sensor networks (WSNs) and their applications has attracted remarkable growth in unsolicited intrusions and security threats, which disrupt the normal operations of the WSNs. Deep learning (DL)-based network intrusion detection (NID) methods have been widely investigated and developed. However, the high computational complexity of DL seriously hinders the actual deployment of the DL-based model, particularly in the devices of WSNs that do not have powerful processing performance due to power limitation. In this letter, we propose a lightweight dynamic autoencoder network (LDAN) method for NID, which realizes efficient feature extraction through lightweight structure design. Experimental results show that our proposed model achieves high accuracy and robustness while greatly reducing computational cost and model size.