Intrusion Detection System Model Research Articles

Composition of Hybrid Deep Learning Model and Feature Optimization for Intrusion Detection System

Recently, with the massive growth of IoT devices, the attack surfaces have also intensified. Thus, cybersecurity has become a critical component to protect organizational boundaries. In networks, Intrusion Detection Systems (IDSs) are employed to raise critical flags during network management. One aspect is malicious traffic identification, where zero-day attack detection is a critical problem of study. Current approaches are aligned towards deep learning (DL) methods for IDSs, but the success of the DL mechanism depends on the feature learning process, which is an open challenge. Thus, in this paper, the authors propose a technique which combines both CNN, and GRU, where different CNN-GRU combination sequences are presented to optimize the network parameters. In the simulation, the authors used the CICIDS-2017 benchmark dataset and used metrics such as precision, recall, False Positive Rate (FPR), True Positive Rate (TRP), and other aligned metrics. The results suggest a significant improvement, where many network attacks are detected with an accuracy of 98.73%, and an FPR rate of 0.075. We also performed a comparative analysis with other existing techniques, and the obtained results indicate the efficacy of the proposed IDS scheme in real cybersecurity setups.

A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection

Ensuring security of Internet of Things (IoT) devices in the face of threats and attacks is a primary concern. IoT plays an increasingly key role in cyber–physical systems. Many existing intrusion detection systems (IDS) proposals for the IoT leverage complex machine learning architectures, which often provide one separate model per device or per attack. These solutions are not suited to the scale and dynamism of modern IoT networks. This paper proposes a novel IoT-driven cross-device method, which allows learning a single IDS model instead of many separate models atop the traffic of different IoT devices. A semi-supervised approach is adopted due to its wider applicability for unanticipated attacks. The solution is based on an all-in-one deep autoencoder, which consists of training a single deep neural network with the normal traffic from different IoT devices. Extensive experimentation performed with a widely used benchmarking dataset indicates that the all-in-one approach achieves within 0.9994–0.9997 recall, 0.9999–1.0 precision, 0.0–0.0071 false positive rate and 0.9996–0.9998 F1 score, depending on the device. The results obtained demonstrate the validity of the proposal, which represents a lightweight and device-independent solution with considerable advantages in terms of transferability and adaptability.

Modified Metaheuristics with Weighted Majority Voting Ensemble Deep Learning Model for Intrusion Detection System

Modified Metaheuristics with Weighted Majority Voting Ensemble Deep Learning Model for Intrusion Detection System

Unraveling the Decision-making Process Interpretable Deep Learning IDS for Transportation Network Security

The growing ubiquity of IoT-enabled devices in recent years emphasizes the critical need to strengthen transportation network safety and dependability. Intrusion detection systems (IDS) are crucial in preventing attacks on transport networks that rely on the Internet of Things (IoT). However, understanding the rationale behind deep learning-based IDS models may be challenging because they do not explain their findings. We offer an interpretable deep learning system that may be used to improve transportation network safety using IoT. To develop naturally accessible explanations for IDS projections, we integrate deep learning models with the Shapley Additive Reasons (SHAP) approach. By adding weight to distinct elements of the input data needed to develop the model, we increase the readability of so-called black box processes. We use the ToN_IoT dataset, which provides statistics on the volume of network traffic created by IoT-enabled transport systems, to assess the success of our strategy. We use a tool called CICFlowMeter to create network flows and collect data. The regularity of the flows, as well as their correlation with specific assaults, has been documented, allowing us to train and evaluate the IDS model. The experiment findings show that our explainable deep learning system is extremely accurate at detecting and categorising intrusions in IoT-enabled transportation networks. By examining data using the SHAP approach, cybersecurity specialists may learn more about the IDS's decision-making process. This enables the development of robust solutions, which improves the overall security of the Internet of Things. Aside from simplifying IDS predictions, the proposed technique provides useful recommendations for strengthening the resilience of IoT-enabled transportation systems against cyberattacks. The usefulness of IDS in defending mission critical IoT infrastructure has been questioned by security experts in the Internet of Vehicles (IoV) industry. The IoV is the primary research object in this case. Deep learning algorithms' versatility in processing many forms of data has contributed to their growing prominence in the field of anomaly detection in intrusion detection systems. Although machine learning models may be highly useful, they frequently yield false positives, and the path they follow to their conclusions is not always obvious to humans. Cybersecurity experts who want to evaluate the performance of a system or design more secure solutions need to understand the thinking process behind an IDS's results. The SHAP approach is employed in our proposed framework to give greater insight into the decisions made by IDSs that depend on deep learning. As a result, IoT network security is strengthened, and more cyber-resilient systems are developed. We demonstrate the effectiveness of our technique by comparing it to other credible methods and utilising the ToN_IoT dataset. Our framework has the best success rate when compared to other frameworks, as evidenced by testing results showing an F1 score of 98.83 percent and an accuracy of 99.15 percent. These findings demonstrate that the architecture successfully resists a variety of destructive assaults on IoT networks. By integrating deep learning and methodologies with an emphasis on explainability, our approach significantly enhances network security in IoT use scenarios. The ability to assess and grasp IDS options provides the path for cybersecurity experts to design and construct more secure IoT systems.

Optimal Deep Learning Driven Intrusion Detection in SDN-Enabled IoT Environment

In recent years, wireless networks are widely used in different domains. This phenomenon has increased the number of Internet of Things (IoT) devices and their applications. Though IoT has numerous advantages, the commonly-used IoT devices are exposed to cyber-attacks periodically. This scenario necessitates real-time automated detection and the mitigation of different types of attacks in high-traffic networks. The Software-Defined Networking (SDN) technique and the Machine Learning (ML)-based intrusion detection technique are effective tools that can quickly respond to different types of attacks in the IoT networks. The Intrusion Detection System (IDS) models can be employed to secure the SDN-enabled IoT environment in this scenario. The current study devises a Harmony Search algorithm-based Feature Selection with Optimal Convolutional Autoencoder (HSAFS-OCAE) for intrusion detection in the SDN-enabled IoT environment. The presented HSAFS-OCAE method follows a three-stage process in which the Harmony Search Algorithm-based FS (HSAFS) technique is exploited at first for feature selection. Next, the CAE method is leveraged to recognize and classify intrusions in the SDN-enabled IoT environment. Finally, the Artificial Fish Swarm Algorithm (AFSA) is used to fine-tune the hyperparameters. This process improves the outcomes of the intrusion detection process executed by the CAE algorithm and shows the work’s novelty. The proposed HSAFS-OCAE technique was experimentally validated under different aspects, and the comparative analysis results established the supremacy of the proposed model.

Comparative Analysis of Intrusion Detection Systems and Machine Learning-Based Model Analysis Through Decision Tree

Comparative Analysis of Intrusion Detection Systems and Machine Learning-Based Model Analysis Through Decision Tree

Enhanced Coyote Optimization with Deep Learning Based Cloud-Intrusion Detection System

Cloud Computing (CC) is the preference of all information technology (IT) organizations as it offers pay-per-use based and flexible services to its users. But the privacy and security become the main hindrances in its achievement due to distributed and open architecture that is prone to intruders. Intrusion Detection System (IDS) refers to one of the commonly utilized system for detecting attacks on cloud. IDS proves to be an effective and promising technique, that identifies malicious activities and known threats by observing traffic data in computers, and warnings are given when such threats were identified. The current mainstream IDS are assisted with machine learning (ML) but have issues of low detection rates and demanded wide feature engineering. This article devises an Enhanced Coyote Optimization with Deep Learning based Intrusion Detection System for Cloud Security (ECODL-IDSCS) model. The ECODL-IDSCS model initially addresses the class imbalance data problem by the use of Adaptive Synthetic (ADASYN) technique. For detecting and classification of intrusions, long short term memory (LSTM) model is exploited. In addition, ECO algorithm is derived to optimally fine tune the hyperparameters related to the LSTM model to enhance its detection efficiency in the cloud environment. Once the presented ECODL-IDSCS model is tested on benchmark dataset, the experimental results show the promising performance of the ECODL-IDSCS model over the existing IDS models.

Anomaly-Based Intrusion Detection System using One-Dimensional Convolutional Neural Network

As technologies in information and virtualization evolve, the volume of security threats attempting to cause damage to systems grows and becomes more powerful, which highlights the importance of Intrusion Detection Systems (IDS) to have an essential role in network security and help in detecting malicious attacks from network traffic. The most widely used network anomaly detection systems are based on Machine Learning (ML) techniques such as Decision Tree (DT), Support Vector Machine (SVM), and K-nearest Neighbors (KNN). Although IDSs based on ML techniques have achieved promising results and high detection rates, however, it is considered a type of shallow learning that depends mainly on feature engineering and requires large-scale data pre-processing as the size of the dataset grows. To overcome these problems, Deep learning-based IDSs are proposed because they have a better ability to extract features from huge amounts of data. In this research, an IDS model based on one-dimensional Convolution Neutron Network (CNN1D) is proposed that is able to detect anomalies with accuracy of 93.2% and F1-score of 93.1%. Entire NSL-KDD benchmark dataset was used to train this model. Achieved results are then compared to Deep Learning (DL) methods like CNN, LSTM, Recurrent Neural Network (RNN), and others to prove the proposed model's superiority over existing models in literature.

Improved Monarchy Butterfly Optimization Algorithm (IMBO): Intrusion Detection Using Mapreduce Framework Based Optimized ANU-Net

The demand for cybersecurity is rising recently due to the rapid improvement of network technologies. As a primary defense mechanism, an intrusion detection system (IDS) was anticipated to adapt and secure computing infrastructures from the constantly evolving, sophisticated threat landscape. Recently, various deep learning methods have been put forth; however, these methods struggle to recognize all forms of assaults, especially infrequent attacks, because of network traffic imbalances and a shortage of aberrant traffic samples for model training. This work introduces deep learning (DL) based Attention based Nested U-Net (ANU-Net) for intrusion detection to address these issues and enhance detection performance. For this IDS model, the first data preprocessing is carried out in three stages: duplication elimination, label transformation, and data normalization. Then the features are extracted and selected based on the Improved Flower Pollination Algorithm (IFPA). The Improved Monarchy Butterfly Optimization Algorithm (IMBO), a new metaheuristic, is used to modify the hyper-parameters in ANU-Net, effectively increasing the learning rate for spatial-temporal information and resolving the imbalance problem. Through the use of parallel programming, the MapReduce architecture reduces computation complexity while significantly accelerating processing. Three publicly available data sets were used to evaluate and test the approach. The investigational outcomes suggest that the proposed technique can more efficiently boost the performances of IDS under the scenario of unbalanced data. The proposed method achieves above 98% accuracy and classifies various attacks significantly well compared to other classifiers.

A hybrid deep learning-based intrusion detection system for IoT networks.

The Internet of Things (IoT) is a rapidly evolving technology with a wide range of potential applications, but the security of IoT networks remains a major concern. The existing system needs improvement in detecting intrusions in IoT networks. Several researchers have focused on intrusion detection systems (IDS) that address only one layer of the three-layered IoT architecture, which limits their effectiveness in detecting attacks across the entire network. To address these limitations, this paper proposes an intelligent IDS for IoT networks based on deep learning algorithms. The proposed model consists of a recurrent neural network and gated recurrent units (RNN-GRU), which can classify attacks across the physical, network, and application layers. The proposed model is trained and tested using the ToN-IoT dataset, specifically collected for a three-layered IoT system, and includes new types of attacks compared to other publicly available datasets. The performance analysis of the proposed model was carried out by a number of evaluation metrics such as accuracy, precision, recall, and F1-measure. Two optimization techniques, Adam and Adamax, were applied in the evaluation process of the model, and the Adam performance was found to be optimal. Moreover, the proposed model was compared with various advanced deep learning (DL) and traditional machine learning (ML) techniques. The results show that the proposed system achieves an accuracy of 99% for network flow datasets and 98% for application layer datasets, demonstrating its superiority over previous IDS models.

An Approach for Identifying Network Intrusion in an Automated Process Control Computer System

Technology and networks have improved significantly in recent decades, and Internet services are now available in almost every business. It has become increasingly important to develop information security technology to identify the most recent attack as hackers are getting better at stealing information. The most important technology for security is an Intrusion Detection System (IDS) which employs machine learning and deep learning technique to identify network irregularities. To detect an unknown attack, we propose to use a new intrusion detection system using a deep neural network methodology which provides excellent performance to detect intrusion. This research focuses on an automated process control computer system that recognizes, records, analyzes, and correlates threats to online safety. In addition, two different methods are used to detect an attack (the binary classification and the multiclass classification). One of the most promising features of the proposed technique is its accuracy (98.99 percent with the multiclass classification and the binary classification). The proposed method's first step creates a model for a multiclass intrusion detection system based on CNN. FOA (Fruit Fly Optimization Algorithm) is used in the process's pre-training phase to address the class imbalance issue. Each batch is obtained during the training process using the resampling method following the resampling weights, which are the results of the pre-training procedure.

Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID

Technological breakthroughs in the Internet of Things (IoT) easily promote smart lives for humans by connecting everything through the Internet. The de facto standardised IoT routing strategy is the routing protocol for low-power and lossy networks (RPL), which is applied in various heterogeneous IoT applications. Hence, the increase in reliance on the IoT requires focus on the security of the RPL protocol. The top defence layer is an intrusion detection system (IDS), and the heterogeneous characteristics of the IoT and variety of novel intrusions make the design of the RPL IDS significantly complex. Most existing IDS solutions are unified models and cannot detect novel RPL intrusions. Therefore, the RPL requires a customised global attack knowledge-based IDS model to identify both existing and novel intrusions in order to enhance its security. Federated transfer learning (FTL) is a trending topic that paves the way to designing a customised RPL-IoT IDS security model in a heterogeneous IoT environment. In this paper, we propose a federated-transfer-learning-assisted customised distributed IDS (FT-CID) model to detect RPL intrusion in a heterogeneous IoT. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection. Initially, the central server initialises the FT-CID with a predefined learning model and observes the unique features of different RPL-IoTs to construct a local model. The experimental model generates an RPL-IIoT dataset with normal and abnormal traffic through simulation on the Contiki-NG OS. Secondly, the edge IDSs are trained using the local parameters and the globally shared parameters generated by the central server through federation and aggregation of different local parameters of various edges. Hence, transfer learning is exploited to update the server's and edges' local and global parameters based on relational knowledge. It also builds and customised IDS model with partial retraining through local learning based on globally shared server knowledge. Finally, the customised IDS in the FT-CID model enforces the detection of intrusions in heterogeneous IoT networks. Moreover, the FT-CID model accomplishes high RPL security by implicitly utilising the local and global parameters of different IoTs with the assistance of FTL. The FT-CID detects RPL intrusions with an accuracy of 85.52% in tests on a heterogeneous IoT network.

Evaluation of Efficient Classification Algorithm for Intrusion Detection System

Intrusion detection system is one of the most significant network security problems in the technology world. To improve the Intrusion Detection System (IDS) many machine learning methods are implemented. In order to develop the performance of IDS, different classification algorithms are applied to detect different types of attacks. For building efficient IDS is not an easy task and choosing a suitable classification algorithm. The best method is to test the Performance of the different classification algorithms and select best method from them. This paper aim is to assemble an IDS model in terms of confusion matrix, accuracy, recall, precision, f-score, specificity and sensitivity. It also provides a detailed comparison with the dataset, data preprocessing, number of features selected, feature selection technique, classification algorithms, and evaluation performance of algorithms described in the intrusion detection system.

Intrusion Detection System for IoT Using Logical Analysis of Data and Information Gain Ratio

The rapidly increasing use of the internet has led to an increase in new devices and technologies; however, attack and security violations have grown exponentially as well. In order to detect and prevent attacks, an Intrusion Detection System (IDS) is proposed using Logical Analysis of Data (LAD). Logical Analysis of Data is a data analysis technique that classifies data as either normal or an attack based on patterns. A pattern generation approach is discussed using the concept of Boolean functions. The IDS model is trained and tested using the Bot-IoT dataset. The model achieves an accuracy of 99.98%, and is able to detect new attacks with good precision and recall.

Intrusion Detection System for Internet of Vehicles Based on Ensemble Learning and CNN

With the combination of network and automotive technology, more and more modern cars are controlled based on electronic control units (ECUs). And multiple ECUs in modern cars are interconnected and cooperate through the in-vehicle network. But such in-vehicle networks do not consider potential security issues, which might lead to property damage and life threat. An intrusion Detection System (IDS) is a method to detect anomalies and warn about network intrusions. In this study, an IDS model based on Convolutional Neural Networks (CNNs) and ensemble learning is proposed. Meanwhile, to further improve the capability of the proposed IDS model, the structure of some CNN basic models is modified. Finally, the proposed model is validated on a representative standard Internet of Vehicles (IoV) dataset Car-Hacking Dataset. In the experiment, the proposed model achieves 100% accuracy and fl-score, and the detection time is from 1.0ms to 2.8ms, which demonstrates that the proposed IDS model detects the effectiveness of network intrusions.

Genetic programming support vector machine model for a wireless intrusion detection system

Objectives. The rapid penetration of wireless communication technologies into the activities of both humans and Internet of Things (IoT) devices along with their widespread use by information consumers represents an epochal phenomenon. However, this is accompanied by the growing intensity of successful information attacks, involving the use of bot attacks via IoT, which, along with network attacks, has reached a critical level. Under such circumstances, there is an increasing need for new technological approaches to developing intrusion detection systems based on the latest achievements of artificial intelligence. The most important requirement for such a system consists in its operation on various unbalanced sets of attack data, which use different intrusion techniques. The synthesis of such an intrusion detection system is a difficult task due to the lack of universal methods for detecting technologically different attacks; moreover, the consistent application of known methods is unacceptably long. The aim of the present work is to eliminate such a scientific gap.Methods. Using the achievements of artificial intelligence in the fight against attacks, the authors proposed a method based on a combination of the genetic programming support vector machine (GPSVM) model using an unbalanced CICIDS2017 dataset.Results. The presented technological intrusion detection system architecture offers the possibility to train a dataset for detecting attacks on CICIDS2017 and extracting detection objects. The architecture provides for the separation of the dataset into verifiable and not verifiable elements, with the latter being added to the training set by feedback. By training the model and improving GPSVM training set, better accuracy is ensured. The operability of the new flowchart of the GPSVM model is demonstrated in terms of the entry of input data and output of data after processing using the training set of the GPSVM model. Numerical analysis based on the results of model experiments on selected quality indicators showed an increase in the accuracy of the results as compared to the known SVM method.Conclusions. Computer experiments have confirmed the methodological correctness of choosing a combination of the GPSVM model using an unbalanced CICIDS2017 dataset to increase the effectiveness of intrusion detection. A procedure for forming a training dataset based on feedback is proposed. The procedure involving the separation of datasets is shown to create conditions for improving the training of the model. The combination of the GPSVM model with an unbalanced CICIDS2017 dataset to collect a sample increases theaccuracy of intrusion detection to provide improved intrusion detection performance as compared to the SVM method.

Mutual clustered redundancy assisted feature selection for an intrusion detection system

Intrusion Detection is very important in computer networks because the widespread of internet makes the computers more prone to several cyber-attacks. With this inspiration, a new paradigm called Intrusion Detection System (IDS) has emerged and attained a huge research interest. However, the major challenge in IDS is the presence of redundant and duplicate information that causes a serious computational problem in network traffic classifications. To solve this problem, in this paper, we propose a novel IDS model based on statistical processing techniques and machine learning algorithms. The machine learning algorithms incudes Fuzzy C-means and Support Vector Machine while the statistical processing techniques includes correlation and Joint Entropy. The main purpose of FCM is to cluster the train data and SVM is to classify the traffic connections. Next, the main purpose of correlation is to discover and remove the duplicate connections from every cluster while the Joint entropy is applied for the discovery and removal of duplicate features from every connection. For experimental validation, totally three standard datasets namely KDD Cup 99, NSL-KDD and Kyoto2006+ are considered and the performance is measured through Detection Rate, Precision, F-Score, and accuracy. A five-fold cross validation is done on every dataset by changing the traffic and the obtained average performance is compared with existing methods.

Performance Investigation of Principal Component Analysis for Intrusion Detection System Using Different Support Vector Machine Kernels

The growing number of security threats has prompted the use of a variety of security techniques. The most common security tools for identifying and tracking intruders across diverse network domains are intrusion detection systems. Machine Learning classifiers have begun to be used in the detection of threats, thus increasing the intrusion detection systems’ performance. In this paper, the investigation model for an intrusion detection systems model based on the Principal Component Analysis feature selection technique and a different Support Vector Machine kernels classifier is present. The impact of various kernel functions used in Support Vector Machines, namely linear, polynomial, Gaussian radial basis function, and Sigmoid, is investigated. The performance of the investigation model is measured in terms of detection accuracy, True Positive, True Negative, Precision, Sensitivity, and F-measure to choose an appropriate kernel function for the Support Vector Machine. The investigation model was examined and evaluated using the KDD Cup’99 and UNSW-NB15 datasets. The obtained results prove that the Gaussian radial basis function kernel is superior to the linear, polynomial, and sigmoid kernels in both used datasets. Obtained accuracy, Sensitivity, and, F-measure of the Gaussian radial basis function kernel for KDD CUP’99 were 99.11%, 98.97%, and 99.03%. for UNSW-NB15 datasets were 93.94%, 93.23%, and 94.44%.

Intelligent Intrusion Detection Using Arithmetic Optimization Enabled Density Based Clustering with Deep Learning

Rapid advancements in the internet and communication domains have led to a massive rise in the network size and the equivalent data. Consequently, several new attacks have been created and pose several challenging issues for network security. In addition, the intrusions can launch several attacks and can be handled by the use of intrusion detection system (IDS). Though several IDS models are available in the literature, there is still a need to improve the detection rate and decrease the false alarm rate. The recent developments of machine learning (ML) and deep learning (DL)-based IDS systems are being deployed as possible solutions for effective intrusion detection. In this work, we propose an arithmetic optimization-enabled density-based clustering with deep learning (AOEDBC-DL) model for intelligent intrusion detection. The presented AOEDBC-DL technique follows a data clustering process to handle the massive quantity of network data traffic. To accomplish this, the AOEDBC-DL technique applied a density-based clustering technique and the initial set of clusters are initialized using the arithmetic optimization algorithm (AOA). In order to recognize and classify intrusions, a bidirectional long short term memory (BiLSTM) mechanism was exploited in this study. Eventually, the AOA was applied as a hyperparameter tuning procedure of the BiLSTM model. The experimental result analysis of the AOEDBC-DL algorithm was tested using benchmark IDS datasets. Extensive comparison studies highlighted the enhancements of the AOEDBC-DL technique over other existing approaches.

ILL-IDS: An incremental lifetime learning IDS for VANETs

Vehicle Ad Hoc Network (VANET) is one of the most important approaches for intelligent vehicles to communicate under complex road conditions. However, as a VANET is working under wireless and complex conditions, it is under the threat of various malicious attacks. One efficient solution to counter those attacks is the Intrusion Detection System (IDS), which can detect intrusions to the VANET based on the statistical machine learning method. However, most IDS solutions have a problem that they can only detect the attacks which have already known when the IDS is designed/trained. For unknown attacks, most IDSs become inefficient. A blockchain-based Lifetime Learning IDS (LL-IDS) framework has been designed to address this problem. It applies a blockchain to store uncertain data that an IDS cannot decide and is highly likely to be a new type of attacks. With the help of traditional security agencies such as universities, these uncertain data can be labelled to train the IDS model. The incremental learning models are shown to have a great potential in this scenario. In this paper, we introduces a novel IDS named as incremental IDS based on LL-IDS. Numerical experiments show that the computational time consumption and web payload could be decreased by applying the ILL-IDS to a public VANET dataset.