Network-based Intrusion Prevention System Research Articles

Simulation and modeling of deep adversarial probabilistic neural network-based intrusion prevention system in cloud computing for smart grid cyber physical systems

Smart Grid Cyber Physical Systems (SG-CPS) have a substantial impact on power grid infrastructure upgrading. Nonetheless, due to the sophisticated nature of the infrastructure and the critical demand for resilient intrusion prevention systems, the task of protecting its security against data integrity attacks is a significant challenge. The simulation and assessment of security performance in SG-CPS present substantial hurdles in real-world power grid systems, owing mostly to experimental constraints. This necessitates the development of novel ways to improve distribution chain security. This research introduces a novel approach, employing a Deep Adversarial Probabilistic Neural Network (DAPNN)-based Intrusion prevention system in a cloud environment. Combining Bayesian Probabilistic Neural Networks (BEPNNs) with adversarial training and rule-based decision-making enhances precision and resilience. The major goal of this research is to detect and counteract false data injection (FDI) attacks that have the potential to compromise the integrity of power grid data. This paper proposes a novel methodology for intrusion detection in SG-CPS that combines BEPNNs with adversarial training. The addition of rule-based decision-making improves the system’s precision and resilience. The IEEE 24-bus system provides the foundation for providing data points relevant to normal operating conditions, contingency scenarios, and intentional attacks. The training procedure includes the use of a BEPNN for feature extraction, as well as the use of adversarial training approaches. The intrusion detection system has decision-making logic based on rules. The cloud infrastructure solution used in the study is Microsoft Azure. The results show that the DAPNN-based Intrusion Prevention System is effective in detecting and mitigating FDI attacks in SG-CPS. The system outperforms in terms of accuracy, precision, recall and F-measure, hence improving the security of the power grid infrastructure.

A Hybrid Particle Swarm Optimization and C4.5 for Network Intrusion Detection and Prevention System

Network Intrusion Detection and Prevention systems (NIDPS) ensure network security and used to effectively detect various attacks and completely stop them from intruding over a network. Since, securing sensitive information carried by various organizations is much more significant, developing enhanced security models become inevitable. To meet the growing demand in safeguarding the network from various known and unknown attacks. In this paper, a Hybrid Particle Swarm Optimization and C4.5 (HPSOCM) method is proposed to network based intrusion prevention system to detect unknown attacks and a signature based SNORT method to detect the known attacks in NIDS. In the hybrid method, we use data mining approach to mine the unknown attacks. Hence, we develop an anomalous detection model and train it using the data mining rules. The trained network is capable of detecting various unknown attacks. The conventional signature based SNORT method detects the known attacks by matching the detected threats from the KDD99 dataset. The proposed HPSOCM method is demonstrated using simulation and the performances were evaluated in terms of Accuracy, Specificity, Detection Rate and False Alarm Rate. The proposed method had produced better efficiency compared to various other existing methods.

Application of Artificial Intelligence to Software Defined Networking: A Survey

Background/Objectives: This paper surveys the application of Artificial Intelligence (AI) to the Software Defined Networking (SDN) paradigm which is a part of previous efforts to give the computer networks the ability of being programmed based on the separation between the control and forwarding planes. In SDN approach, the controller represents the central brain of the network which leads to an advanced level of flexibility and network intelligence. Methods/Statistical Analysis: Different artificial intelligence-based techniques have been applied to achieve an enhanced load balance, network security and intelligent network applications in the SDN approach. Findings: Ant colony algorithms were successful in increasing the maximal Quality of Experience (QoE) by 24.1% compared with the shortest path routing approach. Neural network based intrusion prevention system has shown a scalable performance with low false positive rate. Applying reinforcement learning based technique in adaptive video streaming system compared with the shortest path routing and greedy-based approaches has shown decreasing of the frame loss rate by 89% and 70% respectively. Applications/Improvements: This study highlights the first attempts for applying artificial intelligence in SDN paradigm. However, hybrid intelligent techniques could be the key for achieving more advanced behaviour in SDN-based networks.

Performance Evaluation of Queueing Mechanisms for Network-based Intrusion Prevention System

Performance Evaluation of Queueing Mechanisms for Network-based Intrusion Prevention System

Discovery and prevention of attack episodes by frequent episodes mining and finite state machines

This paper proposes a framework that applies frequent episode rules, implemented by finite state machines (FSMs), to design a real-time network-based intrusion prevention system (NIPS) for Probe/Exploit (hacking) intrusion. This type of Probe/Exploit (hacking) intrusion is executed by a series of relevant actions that occur in some sequence. In frequent episode rules mining, data are viewed as a sequence of events, where each event has an associated time of occurrence; thus, such mining technique has significant effect on discovering sophisticated Probe/Exploit intrusion attacks. Prior to a devastating attack on a victim's computer, the hacker must gather information about the victim, and transfer instructions or files to the victim's computer. The proposed system could detect such abnormal episodes and repel hackers from the firewall before they are able to launch a deadly attack. In one network service (a corresponding port number), mine frequent episode rules from the log files of a commercial honeypot system, then refine the rules, which eventually constructs a finite state machine to protect the network service, according to the refined rules. During implementation and simulation, this study applied the framework focus on protecting a Server Message Block (SMB) protocol, which is the most important protocol in Microsoft's Windows Network. As confirmed in the experiments, this study successfully mined sophisticated intrusion episodes and demonstrated the efficiency of tracing connections by a FSM. The framework of intrusion prevention proposed in this paper can be modified straightforward to protect other network services.