Network-based Intrusion Detection Research Articles

A Survey on Malware Detection and Analysis

Malware, or malicious software, poses a significant threat to the security and functionality of computer systems globally. This survey provides a comprehensive analysis of current malware detection and analysis methods, focusing on data mining methodologies. The study categorizes malware detection techniques into signature-based and behaviour-based approaches, highlighting their respective strengths and weaknesses. It explores heuristic techniques enhanced by artificial intelligence, including neural networks and genetic algorithms, to improve detection accuracy. The literature review examines host-based and network-based intrusion detection systems, hybrid systems, and virtual machine introspection. The paper also discusses static and dynamic analysis methods, emphasizing the importance of analysing malware in controlled environments. Through detailed examination, this survey aims to present a thorough understanding of contemporary malware detection strategies and their applications, offering insights for future advancements in the field.

A Survey on Malware Detection and Analysis

Malware, or malicious software, poses a significant threat to the security and functionality of computer systems globally. This survey provides a comprehensive analysis of current malware detection and analysis methods, focusing on data mining methodologies. The study categorizes malware detection techniques into signature-based and behaviour-based approaches, highlighting their respective strengths and weaknesses. It explores heuristic techniques enhanced by artificial intelligence, including neural networks and genetic algorithms, to improve detection accuracy. The literature review examines host-based and network-based intrusion detection systems, hybrid systems, and virtual machine introspection. The paper also discusses static and dynamic analysis methods, emphasizing the importance of analysing malware in controlled environments. Through detailed examination, this survey aims to present a thorough understanding of contemporary malware detection strategies and their applications, offering insights for future advancements in the field.

Enhancing Multi-Class Attack Detection in Graph Neural Network through Feature Rearrangement

As network sizes grow, attack schemes not only become more varied but also increase in complexity. This diversification leads to a proliferation of attack variants, complicating the identification and differentiation of potential threats. Enhancing system security necessitates the implementation of multi-class intrusion detection systems. This approach enables the categorization of incoming network traffic into distinct intrusion types and illustrates the specific attack encountered within the Internet. Numerous studies have leveraged deep learning (DL) for Network-based Intrusion Detection Systems (NIDS), aiming to improve intrusion detection. Among these DL algorithms, Graph Neural Networks (GNN) stand out for their ability to efficiently process unstructured data, especially network traffic, making them particularly suitable for NIDS applications. Although NIDS usually monitors incoming and outgoing flows in a network, represented as edge features in graph format, traditional GNN studies only consider node features, overlooking edge features. This oversight can result in losing important flow data and diminish the system’s ability to detect attacks effectively. To address this limitation, our research makes several key contributions: (1) Emphasize the significance of edge features for enhancing GNN for multi-class intrusion detection, (2) Utilize port information, which is essential for identifying attacks but often overlooked during training, (3) Reorganize features embedded within the graph. By doing this, the graph can represent close to the actual network, which is the node showing endpoint identification information such as IP addresses and ports; the edge contains information related to flow such as Duration, Number of Packet/s, and Length…; (4) Compared to traditional methods, our experiments demonstrate significant performance improvements on both CIC-IDS-2017 (98.32%) and UNSW-NB15 (96.71%) datasets.

A Case Study of Network-Based Intrusion Detection System Deployment in Industrial Control Systems with Network Isolation

A Case Study of Network-Based Intrusion Detection System Deployment in Industrial Control Systems with Network Isolation

Ensemble averaging deep neural network for botnet detection in heterogeneous Internet of Things devices

The botnet attack is one of the coordinated attack types that can infect Internet of Things (IoT) devices and cause them to malfunction. Botnets can steal sensitive information from IoT devices and control them to launch another attack, such as a Distributed Denial-of-Service (DDoS) attack or email spam. This attack is commonly detected using a network-based Intrusion Detection System (NIDS) that monitors the network device’s activity. However, IoT network is dynamic and IoT devices have many types with different configurations and vendors in IoT environments. Therefore, this research proposes an Intrusion Detection System (IDS) by ensemble-ing traffic from heterogeneous IoT devices. This research proposes Deep Neural Network (DNN) to create a training model from each heterogeneous IoT device. After that, each training model from each heterogeneous IoT device is used to predict the traffic. The prediction results from each training model are averaged using the ensemble averaging method to determine the final result. This research used the N-BaIoT dataset to validate the proposed IDS model. Based on experimental results, ensemble averaging DNN can detect botnet attacks in heterogeneous IoT devices with an average accuracy of 97.21, precision of 91.41, recall of 87.31, and F1-score 88.48.

Retraction Note: FSO-LSTM IDS: hybrid optimized and ensembled deep-learning network-based intrusion detection system for smart networks

Retraction Note: FSO-LSTM IDS: hybrid optimized and ensembled deep-learning network-based intrusion detection system for smart networks

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Network Security Enhanced with Deep Neural Network-Based Intrusion Detection System

Barnacles Mating Optimizer with Hopfield Neural Network Based Intrusion Detection in Internet of Things Environment

Barnacles Mating Optimizer with Hopfield Neural Network Based Intrusion Detection in Internet of Things Environment

Semi-Supervised Alert Filtering for Network Security

Network-based intrusion detection systems play a pivotal role in cybersecurity, but they generate a significant number of alerts. This leads to alert fatigue, a phenomenon where security analysts may miss true alerts hidden among false ones. To address alert fatigue, practical detection systems enable administrators to divide alerts into multiple groups by the alert name and the related Internet Protocol (IP) address. Then, some groups are deliberately ignored to conserve human resources for further analysis. However, the drawback of this approach is that the filtering basis is so coarse-grained that some true alerts are also ignored, which may cause critical security issues. In this paper, we present a new semi-supervised and fine-grained filtering method that uses not only alert names and IP addresses but also semi-supervised clustering results from the alerts. We evaluate our scheme with both a private dataset from a security operations center and a public dataset from the Internet. The experimental results demonstrate that the new filtering scheme achieves higher accuracy and saves more human resources compared to the current state-of-the-art method.

Network Based Intrusion Detection System Using Weighted Product Model (WPM)

A security technology called a network-based intrusion detection system (NIDS) was created to safeguard computer networks against unauthorised access and criminal activity. This technology works by analysing network traffic, spotting potential risks, and informing administrators of any possible incursions or attacks. NIDS research ensures that intrusion detection systems are built to minimise the gathering and storage of sensitive data by taking into account the value of privacy and data protection .In general, network-based intrusion detection system research has a major impact on how well these security measures operate, how efficiently they perform, and how adaptable they are.By addressing the evolving challenges posed by cyber threats, NIDS research helps organizations enhance their network security posture, protect sensitive information, and defend against potential intrusions and attacks." The weighted product model (WPM), a multi-criteria decision-making (MCDM) technique, is used to evaluate and rank solutions based on a variety of distinct criteria. It provides a methodical approach to decision-making by considering the relative importance of each attribute and the performance of other solutions in relation to those criteria. The WPM normalises the data, weights the criteria, and gives a weighted score for each alternative. The option with the greatest score is regarded as the ideal option. The weighted product model offers a structured framework for making decisions by taking into account many factors and their varying degrees of importance. It enables decision-makers to assess and contrast options using a wide range of criteria, resulting in more informed and unbiased choices. It's crucial to check nonetheless that the model's weights and normalisation techniques appropriately capture the decision-maker's preferences as well as the features of the choice problem.J48, Random Forest, JRIP, RIDOR, PART. The definition of true positive, false positive, true negative and false negative rates has already been established. These metrics for measuring the effectiveness of classification algorithms, anomaly detection systems, and binary decision-making processes are accurately presented. As can be seen from the results, J48 received the highest rank, while PART received the lowest .In order to increase the security of computer networks, network-based intrusion detection systems (NIDS) are essential. They provide real-time monitoring and analysis of network traffic to identify suspected breaches and malicious activities, enabling appropriate action to be taken. However, it is important to recognize that NIDS can have limitations and are not infallible.

Enhancing IoT Network Security: Unveiling the Power of Self-Supervised Learning against DDoS Attacks.

The Internet of Things (IoT), projected to exceed 30 billion active device connections globally by 2025, presents an expansive attack surface. The frequent collection and dissemination of confidential data on these devices exposes them to significant security risks, including user information theft and denial-of-service attacks. This paper introduces a smart, network-based Intrusion Detection System (IDS) designed to protect IoT networks from distributed denial-of-service attacks. Our methodology involves generating synthetic images from flow-level traffic data of the Bot-IoT and the LATAM-DDoS-IoT datasets and conducting experiments within both supervised and self-supervised learning paradigms. Self-supervised learning is identified in the state of the art as a promising solution to replace the need for massive amounts of manually labeled data, as well as providing robust generalization. Our results showcase that self-supervised learning surpassed supervised learning in terms of classification performance for certain tests. Specifically, it exceeded the F1 score of supervised learning for attack detection by 4.83% and by 14.61% in accuracy for the multiclass task of protocol classification. Drawing from extensive ablation studies presented in our research, we recommend an optimal training framework for upcoming contrastive learning experiments that emphasize visual representations in the cybersecurity realm. This training approach has enabled us to highlight the broader applicability of self-supervised learning, which, in some instances, outperformed supervised learning transferability by over 5% in precision and nearly 1% in F1 score.

TNN-IDS: Transformer neural network-based intrusion detection system for MQTT-enabled IoT Networks

The Internet of Things (IoT) is a global network that connects a large number of smart devices. MQTT is a de facto standard, lightweight, and reliable protocol for machine-to-machine communication, widely adopted in IoT networks. Various smart devices within these networks are employed to handle sensitive information. However, the scale and openness of IoT networks make them highly vulnerable to security breaches and attacks, such as eavesdropping, weak authentication, and malicious payloads. Hence, there is a need for advanced machine learning (ML) and deep learning (DL)-based intrusion detection systems (IDS). Existing ML-based IoT-IDSs face several limitations in effectively detecting malicious activities, mainly due to imbalanced training data. To address this, this study introduces a transformer neural network-based intrusion detection system (TNN-IDS) specifically designed for MQTT-enabled IoT networks. The proposed approach aims to enhance the detection of malicious activities within these networks. The TNN-IDS leverages the parallel processing capability of the Transformer Neural Network, which accelerates the learning process and results in improved detection of malicious attacks. To evaluate the performance of the proposed system, it was compared with various IDSs based on ML and DL approaches. The experimental results demonstrate that the proposed TNN-IDS outperforms other systems in terms of detecting malicious activity. The TNN-IDS achieved optimum accuracies reaching 99.9% in detecting malicious activities.

A comparative analysis of gradient boosting, random forest and deep neural networks in intrusion detection system

The growing threat of advanced security attacks targeting enterprise information systems raises the need for novel security solutions that promptly identify and respond to these issues. These security strategies must automate threat detection and response in enterprise settings, enabling organizations to address emerging threats, ongoing attacks, and imminent risks adequately. Traditional security strategies that rely on rule-based approaches for intrusion detection systems are inefficient in achieving these objectives due to their limited capabilities in identifying new threats. As a result, machine learning strategies have been proposed to address these needs, offering an intelligent detection environment for novel threats. Classification algorithms such as random forest, gradient boosting and deep learning techniques like deep neural networks have been proposed in various studies. This paper examines the performance of these models, providing a comparative review of their detection capabilities based on precision, recall, accuracy, specificity, and sensitivity. The models are tested using a Python environment due to the extensive machine learning capabilities. These tests show that random forest is the ideal model for network-based intrusion detection systems

Federated learning for reliable model updates in network-based intrusion detection

Machine Learning techniques for network-based intrusion detection are widely adopted in the scientific literature. Besides being highly variable, network traffic behavior changes over time, demanding proposed schemes to be periodically updated to ensure their reliability. Unfortunately, their efficiency is significantly limited in production environments. This paper proposes a new Federated Learning model for reliable network-based intrusion detection with highly confident model updates over time. Our proposed scheme assesses the classification reliability in an unsupervised fashion and rejects potential misclassifications even when outdated. In addition, it significantly eases the model update cost by conducting it in a Federated Learning rationale. To evaluate the effectiveness of our solution, we conduct an experimental campaign with a new dataset, MAWIFlow, with over 7 TB of real network traffic spanning a year. The achieved results of our proposed model are striking. It respectively improves the average false-positive and false-negative rates by up to 12% and 9.6% when no model updates are conducted. If done so, it can further improve the false-positive rate by up to 13% while rejecting only 3.6% of events and demanding only 0.3% of events for model updates. Further, the comparison against the traditional Federated Learning approach confirms our model's remarkable performance in several scenarios. Finally, the quality and viability of our solution do prove that our approach can be successfully adopted for improving the accuracy and efficiency of classification systems in real-world scenarios where outdated models are prevalent and pave the way for future research in the area.

Botnet Detection and Mitigation Model for IoT Networks Using Federated Learning.

The Internet of Things (IoT) introduces significant security vulnerabilities, raising concerns about cyber-attacks. Attackers exploit these vulnerabilities to launch distributed denial-of-service (DDoS) attacks, compromising availability and causing financial damage to digital infrastructure. This study focuses on mitigating DDoS attacks in corporate local networks by developing a model that operates closer to the attack source. The model utilizes Host Intrusion Detection Systems (HIDS) to identify anomalous behaviors in IoT devices and employs network-based intrusion detection approaches through a Network Intrusion Detection System (NIDS) for comprehensive attack identification. Additionally, a Host Intrusion Detection and Prevention System (HIDPS) is implemented in a fog computing infrastructure for real-time and precise attack detection. The proposed model integrates NIDS with federated learning, allowing devices to locally analyze their data and contribute to the detection of anomalous traffic. The distributed architecture enhances security by preventing volumetric attack traffic from reaching internet service providers and destination servers. This research contributes to the advancement of cybersecurity in local network environments and strengthens the protection of IoT networks against malicious traffic. This work highlights the efficiency of using a federated training and detection procedure through deep learning to minimize the impact of a single point of failure (SPOF) and reduce the workload of each device, thus achieving accuracy of 89.753% during detection and increasing privacy issues in a decentralized IoT infrastructure with a near-real-time detection and mitigation system.

Evaluation of Machine Learning Algorithms in Network-Based Intrusion Detection Using Progressive Dataset

Cybersecurity has become one of the focuses of organisations. The number of cyberattacks keeps increasing as Internet usage continues to grow. As new types of cyberattacks continue to emerge, researchers focus on developing machine learning (ML)-based intrusion detection systems (IDS) to detect zero-day attacks. They usually remove some or all attack samples from the training dataset and only include them in the testing dataset when evaluating the performance. This method may detect unknown attacks; however, it does not reflect the long-term performance of the IDS as it only shows the changes in the type of attacks. In this work, we focused on evaluating the long-term performance of ML-based IDS. To achieve this goal, we proposed evaluating the ML-based IDS using a dataset created later than the training dataset. The proposed method can better assess the long-term performance as the testing dataset reflects the changes in the attack type and network infrastructure changes over time. We have implemented six of the most popular ML models, including decision tree (DT), random forest (RF), support vector machine (SVM), naïve Bayes (NB), artificial neural network (ANN), and deep neural network (DNN). These models are trained and tested with a pair of datasets with symmetrical classes. Our experiments using the CIC-IDS2017 and the CSE-CIC-IDS2018 datasets show that SVM and ANN are most resistant to overfitting. Our experiments also indicate that DT and RF suffer the most from overfitting, although they perform well on the training dataset. On the other hand, our experiments using the LUFlow dataset have shown that all models can perform well when the difference between the training and testing datasets is small.

Toward a Reliable Evaluation of Machine Learning Schemes for Network-Based Intrusion Detection

Over the last years, several works introduced network-based intrusion detection schemes based on machine learning techniques for securing IoT devices. Despite the promising results, proposed approaches are rarely adopted in production environments. Networked environments exhibit highly unpredictable behavior, unlike other areas where machine learning has been effectively adopted. Unfortunately, the changing behavior during the time may lead to higher classification errors than those measured in the test phase. In this study, we demonstrate that the existing machine learning techniques applied for network traffic classification fail when facing the characteristics of real-world environments. The experiments analyzed more than 30 TB of data spanning 10 years of real network traffic and 9 intrusion detection datasets. Besides the analysis, we define a set of guidelines to build reliable application of machine learning for network traffic classification, which may guide future research and ensure the reliability of machine learning model deployment in production environments.

Packet Chunking for File Detection

Network-based intrusion detection and data leakage prevention systems inspect packets to detect if critical files such as malware or confidential documents are transferred. However, this kind of detection requires heavy computing resources in reassembling packets and only well-known protocols can be interpreted. Besides, finding similar files from a storage requires pairwise comparisons. In this paper, we present a new network-based file identification scheme that inspects packets independently without reassembly and finds similar files through inverted indexing instead of pairwise comparison. We use a content-based chunking algorithm to consistently divide both files and packets into multiple byte sequences, called chunks. If a packet is a part of a file, they would have common chunks. The challenging problem is that packet chunking and inverted-index search should be fast and scalable enough for packet processing. The file identification should be accurate although many chunks are noises. In this paper, we use a small Bloom filter and a two-level threshold strategy to solve the problems. To the best of our knowledge, this is the first scheme that identifies a specific critical file from a packet over unknown protocols. Experimental results show that the proposed scheme can successfully identify a critical file from a packet without packet reassembly.

Deep Learning-Based Network Intrusion Detection System for Internet of Medical Things

This article presents a deep learning-based approach for network-based intrusion detection in the Internet of medical things (IoMT) systems using features of network flows and patient biometrics. The proposed approach effectively learns optimal feature representation by passing the information of network flows and patient biometrics into more than one hidden layer of deep learning. The network includes a global attention layer which helps to effectively extract the optimal features from the spatial and temporal features of deep learning. To avoid data imbalance, a cost-sensitive learning approach is integrated into the deep learning model. The proposed model showed a 10-fold cross-validation accuracy of 95 percent on network features, 89 percent on patient biometrics, and 99 percent on combined features. In addition to the IoMT environment, the robustness and generalization ability of the proposed model is shown by conducting experiments on other network-based intrusion datasets. The proposed approach outperformed the existing methods in all the test cases mainly showing a 3.9 percent higher accuracy on the IoMT intrusion dataset. The proposed model can be used as an IoMT network monitoring tool to safeguard the IoMT devices and networks from attackers inside the healthcare and medical environment.