Network-based Intrusion Detection System Research Articles

Network-Based Intrusion Detection for Industrial and Robotics Systems: A Comprehensive Survey

In the face of rapidly evolving cyber threats, network-based intrusion detection systems (NIDS) have become critical to the security of industrial and robotic systems. This survey explores the specialized requirements, advancements, and challenges unique to deploying NIDS within these environments, where traditional intrusion detection systems (IDS) often fall short. This paper discusses NIDS methodologies, including machine learning, deep learning, and hybrid systems, which aim to improve detection accuracy, adaptability, and real-time response. Additionally, this paper addresses the complexity of industrial settings, limitations in current datasets, and the cybersecurity needs of cyber–physical Systems (CPS) and Industrial Control Systems (ICS). The survey provides a comprehensive overview of modern approaches and their suitability for industrial applications by reviewing relevant datasets, emerging technologies, and sector-specific challenges. This underscores the importance of innovative solutions, such as federated learning, blockchain, and digital twins, to enhance the security and resilience of NIDS in safeguarding industrial and robotic systems.

Collaborative Intrusion Detection System with Snort Machine Learning Plugin

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

Optimisation of multiple clustering based undersampling using artificial bee colony: Application to improved detection of obfuscated patterns without adversarial training

Attack detection is one of the main features required in modern defence systems. Despite the ongoing research, it remains challenging for a typical mechanism like network-based intrusion detection system (NIDS) to catch up with evolving adversarial attacks. They specifically aim to confuse a machine-learning based predictor. Without the knowledge of adversarial patterns, the best approach is generalising signatures learned from a dataset of legitimate connections and known intrusions. This work focuses on analysing non-payload traffics so that the resulting techniques can be exploited to a range of network-based applications. It investigates a novel means to deal with the problem of imbalanced classes. An optimised undersampling method is introduced to select a subset of majority-class representatives initially created through an ensemble clustering procedure. A weighted combination of criteria representing distributions within and between classes is proposed as the objective function for a global optimisation using the artificial bee colony (ABC). This approach usually outperforms its baselines and other state-of-the-art undersampling models, with ABC being more effective using the global best strategy than a random selection of solutions or an iterative greedy search. The paper also details the parameter analysis offering a heuristic guide for potential taking up of the proposed techniques.

A Deep Learning Approach for Intrusion Detection Systems –A Review

Throughout the past decade, the researchers have developed many a number of intrusion detection systems. Some of these were developed to work on host based and some were network-based intrusion detection systems. The presented systems are combination of HIDS/NIDS and signature/anomaly based, or hybrid systems. The intrusion detection system is an intelligence system known as computational intelligence. The main goal of computational intelligence is to provide solutions to complex real-world problems. An effective IDS must use more than standard mathematical techniques and conventional analysis methods combined with soft computing techniques to synergistically create a more robust IDS. In this paper, we review three important areas of research that have significant implication for proposed framework. First, we review existing shallow learning intrusion detection systems both in machine and deep learning. In the second section, we review existing hybrid intrusion detection systems. Finally, we provide some findings and analysis of the literature studies.

A Survey on Malware Detection and Analysis

Malware, or malicious software, poses a significant threat to the security and functionality of computer systems globally. This survey provides a comprehensive analysis of current malware detection and analysis methods, focusing on data mining methodologies. The study categorizes malware detection techniques into signature-based and behaviour-based approaches, highlighting their respective strengths and weaknesses. It explores heuristic techniques enhanced by artificial intelligence, including neural networks and genetic algorithms, to improve detection accuracy. The literature review examines host-based and network-based intrusion detection systems, hybrid systems, and virtual machine introspection. The paper also discusses static and dynamic analysis methods, emphasizing the importance of analysing malware in controlled environments. Through detailed examination, this survey aims to present a thorough understanding of contemporary malware detection strategies and their applications, offering insights for future advancements in the field.

A COMPREHENSIVE REVIEW OF ARTIFICIAL INTELLIGENCE APPLICATIONS IN ENHANCING CYBERSECURITY THREAT DETECTION AND RESPONSE MECHANISMS

This literature review explores the transformative impact of artificial intelligence (AI) on enhancing cybersecurity measures across various domains. The study systematically examines the integration of AI in Intrusion Detection Systems (IDS), malware detection, phishing detection, threat intelligence, network security, and endpoint protection. Key findings reveal that AI-driven techniques significantly outperform traditional methods, particularly in real-time threat detection, accuracy, and adaptive response capabilities. Network-based IDS benefit from supervised and unsupervised learning algorithms, improving the identification of malicious network traffic and novel attack patterns. In malware detection, AI-enhanced static and dynamic analysis methods surpass signature-based approaches by detecting previously unknown malware and complex behaviors. Phishing detection has seen substantial improvements with AI applications in email filtering and URL analysis, reducing phishing incidents despite challenges like false positives. AI's role in threat intelligence is critical, automating data analysis to uncover hidden threats and employing predictive analytics to anticipate and mitigate cyber attacks. AI techniques in network security and endpoint protection enhance real-time monitoring and authentication processes, providing robust defenses against cyber intrusions. Despite these advancements, challenges such as handling high data volumes and the need for continuous learning to adapt to emerging threats remain. This review underscores the significant advancements, practical implementations, and ongoing challenges of leveraging AI in cybersecurity, highlighting its potential to fortify digital defenses and address the complexities of contemporary cyber threats.

Integrating Behavioral Analytics and Intrusion Detection Systems to Protect Critical Infrastructure and Smart Cities

In an age notable by growing digitization and relatedness, protecting critical infrastructure and smart cities against cyber threats is a biggest obstacle. This abstract examines the combination of Behavioural Analytics (BA) and Intrusion Detection Systems (IDS) as a active and best plan to boost cybersecurity defences. Behavioural Analytics uses machine learning algorithms and statistical models to notice usual entities behaviour patterns inside networks, empowering the identification of anomalies that indicate possible security infringements. This approach is improved through modern techniques that includes Statistical Anomaly Detection, which measures divergence and Long Short-Term Memory (LSTM) networks, skilled at grabbing temporal dependencies in data flow of network pursuit. Cross-Event Correlation methodologies and approaches improve the abilities of IDS by finding similarity between disparate events, giving a broad aspect of possible threats across inter related systems. Entity Behaviour Analysis (EBA) enhance these works by building thorough behaviour profiles and allocating risk scores based on divergence, improving targeted response plans. Network-Based IDS (NIDS) lengthen defence by observing whole networks for unusual activities, while Cyber Threat Intelligence (CTI) devices gives findings into progressing threats, enabling defensive security scales. Convolutional Neural Networks (CNNs) plays a part in removing complicated attribute from network data, improving anomaly detection. The results shows enhancements in threat detection accuracy, with a drop in false positives by 30% and an rise in anomaly detection precision to 95%. The Sensor Data (Units) changes from 80 to 90 units over monitored time periods.

Enhancing Multi-Class Attack Detection in Graph Neural Network through Feature Rearrangement

As network sizes grow, attack schemes not only become more varied but also increase in complexity. This diversification leads to a proliferation of attack variants, complicating the identification and differentiation of potential threats. Enhancing system security necessitates the implementation of multi-class intrusion detection systems. This approach enables the categorization of incoming network traffic into distinct intrusion types and illustrates the specific attack encountered within the Internet. Numerous studies have leveraged deep learning (DL) for Network-based Intrusion Detection Systems (NIDS), aiming to improve intrusion detection. Among these DL algorithms, Graph Neural Networks (GNN) stand out for their ability to efficiently process unstructured data, especially network traffic, making them particularly suitable for NIDS applications. Although NIDS usually monitors incoming and outgoing flows in a network, represented as edge features in graph format, traditional GNN studies only consider node features, overlooking edge features. This oversight can result in losing important flow data and diminish the system’s ability to detect attacks effectively. To address this limitation, our research makes several key contributions: (1) Emphasize the significance of edge features for enhancing GNN for multi-class intrusion detection, (2) Utilize port information, which is essential for identifying attacks but often overlooked during training, (3) Reorganize features embedded within the graph. By doing this, the graph can represent close to the actual network, which is the node showing endpoint identification information such as IP addresses and ports; the edge contains information related to flow such as Duration, Number of Packet/s, and Length…; (4) Compared to traditional methods, our experiments demonstrate significant performance improvements on both CIC-IDS-2017 (98.32%) and UNSW-NB15 (96.71%) datasets.

Probabilistic Analysis of Random Check Intrusion Detection System

The ubiquitous adoption of network-based technologies has left organizations vulnerable to malicious attacks. It has become vital to have effective intrusion detection systems (IDS) that protect the network from attacks. In this paper, we study the intrusion detection problem through the lens of probability theory. We consider a situation where a network receives random malicious signals at discrete time instances, and an IDS attempts to capture these signals via a random check process. We aim to develop a probabilistic framework for intrusion detection under the given scenario. Concretely, we calculate the detection rate of a network attack by an IDS and determine the expected number of detections. We perform extensive theoretical and experimental analyses of the problem. The results presented in this paper would be helpful tools for designing and analyzing intrusion detection systems. We propose a probabilistic framework that could be useful for IDS experts; for a network-based IDS that monitors in real-time, analyzing the entire traffic flow can be computationally expensive. By probabilistically sampling only a fraction of the network traffic, the IDS can still perform its task effectively while reducing the computational cost. However, checking only a fraction of the traffic increases the possibility of missing an attack. This research can help IDS designers achieve appropriate detection rates while maintaining a low false alarm rate. The groundwork laid out in this paper could be used for future research on understanding the probabilities related to intrusion detection.

Artificial Intelligence-Based Intrusion Detection System for Cloud Computing

Abstract: It is possible to communicate with others and do business across this global network, which is comprised of hundreds of millions of computers running a variety of hardware and software configurations. This makes it simpler for hackers to abuse resources and conduct Internet attacks since computers are linked to one another. There are significant roadblocks to the development of a security-oriented approach that may be flexible and adaptive in light of the expanding number of Internet assaults. Threats from the internet could be identified using an intrusion detection system (IDS). The utilization of an intrusion detection system, or IDS, is necessary to preserve network security. Because the cloud platform is continuously expanding and becoming more prevalent in our everyday lives, it is imperative that we develop an effective IDS for it as well. On the other hand, typical intrusion detection systems may encounter difficulties when used in the cloud. A cloud segment may get overburdened by the pre-determined IDS architecture because of the added detection overhead. In the context of a networked system with an adaptable architecture. Using a neural network-based IDS, we show how to make full utilize available resources while not putting undue strain on any single cloud server. The proposed IDS uses a neural network machine learning to identify new threats even more effectively

A Case Study of Network-Based Intrusion Detection System Deployment in Industrial Control Systems with Network Isolation

A Case Study of Network-Based Intrusion Detection System Deployment in Industrial Control Systems with Network Isolation

Ensemble averaging deep neural network for botnet detection in heterogeneous Internet of Things devices

The botnet attack is one of the coordinated attack types that can infect Internet of Things (IoT) devices and cause them to malfunction. Botnets can steal sensitive information from IoT devices and control them to launch another attack, such as a Distributed Denial-of-Service (DDoS) attack or email spam. This attack is commonly detected using a network-based Intrusion Detection System (NIDS) that monitors the network device’s activity. However, IoT network is dynamic and IoT devices have many types with different configurations and vendors in IoT environments. Therefore, this research proposes an Intrusion Detection System (IDS) by ensemble-ing traffic from heterogeneous IoT devices. This research proposes Deep Neural Network (DNN) to create a training model from each heterogeneous IoT device. After that, each training model from each heterogeneous IoT device is used to predict the traffic. The prediction results from each training model are averaged using the ensemble averaging method to determine the final result. This research used the N-BaIoT dataset to validate the proposed IDS model. Based on experimental results, ensemble averaging DNN can detect botnet attacks in heterogeneous IoT devices with an average accuracy of 97.21, precision of 91.41, recall of 87.31, and F1-score 88.48.

Retraction Note: FSO-LSTM IDS: hybrid optimized and ensembled deep-learning network-based intrusion detection system for smart networks

Retraction Note: FSO-LSTM IDS: hybrid optimized and ensembled deep-learning network-based intrusion detection system for smart networks

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Semi-Supervised Alert Filtering for Network Security

Network-based intrusion detection systems play a pivotal role in cybersecurity, but they generate a significant number of alerts. This leads to alert fatigue, a phenomenon where security analysts may miss true alerts hidden among false ones. To address alert fatigue, practical detection systems enable administrators to divide alerts into multiple groups by the alert name and the related Internet Protocol (IP) address. Then, some groups are deliberately ignored to conserve human resources for further analysis. However, the drawback of this approach is that the filtering basis is so coarse-grained that some true alerts are also ignored, which may cause critical security issues. In this paper, we present a new semi-supervised and fine-grained filtering method that uses not only alert names and IP addresses but also semi-supervised clustering results from the alerts. We evaluate our scheme with both a private dataset from a security operations center and a public dataset from the Internet. The experimental results demonstrate that the new filtering scheme achieves higher accuracy and saves more human resources compared to the current state-of-the-art method.

Network Based Intrusion Detection System Using Weighted Product Model (WPM)

A security technology called a network-based intrusion detection system (NIDS) was created to safeguard computer networks against unauthorised access and criminal activity. This technology works by analysing network traffic, spotting potential risks, and informing administrators of any possible incursions or attacks. NIDS research ensures that intrusion detection systems are built to minimise the gathering and storage of sensitive data by taking into account the value of privacy and data protection .In general, network-based intrusion detection system research has a major impact on how well these security measures operate, how efficiently they perform, and how adaptable they are.By addressing the evolving challenges posed by cyber threats, NIDS research helps organizations enhance their network security posture, protect sensitive information, and defend against potential intrusions and attacks." The weighted product model (WPM), a multi-criteria decision-making (MCDM) technique, is used to evaluate and rank solutions based on a variety of distinct criteria. It provides a methodical approach to decision-making by considering the relative importance of each attribute and the performance of other solutions in relation to those criteria. The WPM normalises the data, weights the criteria, and gives a weighted score for each alternative. The option with the greatest score is regarded as the ideal option. The weighted product model offers a structured framework for making decisions by taking into account many factors and their varying degrees of importance. It enables decision-makers to assess and contrast options using a wide range of criteria, resulting in more informed and unbiased choices. It's crucial to check nonetheless that the model's weights and normalisation techniques appropriately capture the decision-maker's preferences as well as the features of the choice problem.J48, Random Forest, JRIP, RIDOR, PART. The definition of true positive, false positive, true negative and false negative rates has already been established. These metrics for measuring the effectiveness of classification algorithms, anomaly detection systems, and binary decision-making processes are accurately presented. As can be seen from the results, J48 received the highest rank, while PART received the lowest .In order to increase the security of computer networks, network-based intrusion detection systems (NIDS) are essential. They provide real-time monitoring and analysis of network traffic to identify suspected breaches and malicious activities, enabling appropriate action to be taken. However, it is important to recognize that NIDS can have limitations and are not infallible.

Enhancing IoT Network Security: Unveiling the Power of Self-Supervised Learning against DDoS Attacks.

The Internet of Things (IoT), projected to exceed 30 billion active device connections globally by 2025, presents an expansive attack surface. The frequent collection and dissemination of confidential data on these devices exposes them to significant security risks, including user information theft and denial-of-service attacks. This paper introduces a smart, network-based Intrusion Detection System (IDS) designed to protect IoT networks from distributed denial-of-service attacks. Our methodology involves generating synthetic images from flow-level traffic data of the Bot-IoT and the LATAM-DDoS-IoT datasets and conducting experiments within both supervised and self-supervised learning paradigms. Self-supervised learning is identified in the state of the art as a promising solution to replace the need for massive amounts of manually labeled data, as well as providing robust generalization. Our results showcase that self-supervised learning surpassed supervised learning in terms of classification performance for certain tests. Specifically, it exceeded the F1 score of supervised learning for attack detection by 4.83% and by 14.61% in accuracy for the multiclass task of protocol classification. Drawing from extensive ablation studies presented in our research, we recommend an optimal training framework for upcoming contrastive learning experiments that emphasize visual representations in the cybersecurity realm. This training approach has enabled us to highlight the broader applicability of self-supervised learning, which, in some instances, outperformed supervised learning transferability by over 5% in precision and nearly 1% in F1 score.

TNN-IDS: Transformer neural network-based intrusion detection system for MQTT-enabled IoT Networks

The Internet of Things (IoT) is a global network that connects a large number of smart devices. MQTT is a de facto standard, lightweight, and reliable protocol for machine-to-machine communication, widely adopted in IoT networks. Various smart devices within these networks are employed to handle sensitive information. However, the scale and openness of IoT networks make them highly vulnerable to security breaches and attacks, such as eavesdropping, weak authentication, and malicious payloads. Hence, there is a need for advanced machine learning (ML) and deep learning (DL)-based intrusion detection systems (IDS). Existing ML-based IoT-IDSs face several limitations in effectively detecting malicious activities, mainly due to imbalanced training data. To address this, this study introduces a transformer neural network-based intrusion detection system (TNN-IDS) specifically designed for MQTT-enabled IoT networks. The proposed approach aims to enhance the detection of malicious activities within these networks. The TNN-IDS leverages the parallel processing capability of the Transformer Neural Network, which accelerates the learning process and results in improved detection of malicious attacks. To evaluate the performance of the proposed system, it was compared with various IDSs based on ML and DL approaches. The experimental results demonstrate that the proposed TNN-IDS outperforms other systems in terms of detecting malicious activity. The TNN-IDS achieved optimum accuracies reaching 99.9% in detecting malicious activities.

A comparative analysis of gradient boosting, random forest and deep neural networks in intrusion detection system

The growing threat of advanced security attacks targeting enterprise information systems raises the need for novel security solutions that promptly identify and respond to these issues. These security strategies must automate threat detection and response in enterprise settings, enabling organizations to address emerging threats, ongoing attacks, and imminent risks adequately. Traditional security strategies that rely on rule-based approaches for intrusion detection systems are inefficient in achieving these objectives due to their limited capabilities in identifying new threats. As a result, machine learning strategies have been proposed to address these needs, offering an intelligent detection environment for novel threats. Classification algorithms such as random forest, gradient boosting and deep learning techniques like deep neural networks have been proposed in various studies. This paper examines the performance of these models, providing a comparative review of their detection capabilities based on precision, recall, accuracy, specificity, and sensitivity. The models are tested using a Python environment due to the extensive machine learning capabilities. These tests show that random forest is the ideal model for network-based intrusion detection systems

Utilizing Machine Learning for Intrusion Detection Systems in the Context of Cloud Computing

The rapid advancements in the internet and communication sectors have led to a huge expansion in the network dimension and the related data. The proliferation of new assault kinds as a result makes it challenging for community safety to accurately identify invasions. Furthermore, the presence of intruders who want to launch a lot of attacks against the network cannot be ignored. An intrusion detection device (IDS) is one such instrument that protects against prospective intrusions by monitoring community communication to guarantee its confidentiality, integrity, and availability. IDS continues to struggle with innovative intrusion detection, lowering false alarm rates, and improving detection accuracy despite substantial research backing. An intrusion detection system's main job is to protect resources against threats. It predicts user behaviour based on analysis, and determines whether that behaviour constitutes an assault or is simply normal behaviour. We use Support Vector Machine (SVM) and Rough Set Theory (RST) to detect network breaches (SVM). Computer learning (ML) and Python-based total IDS systems are recently being employed to identify intrusions across the network in an ecologically friendly manner. The taxonomy presented in this article is mostly based on the impressive machine learning and Python approaches used to develop network-based IDS (NIDS) systems. The article begins by defining IDS.