Network Intrusion Detection Model Research Articles

A novel bidirectional LSTM model for network intrusion detection in SDN-IoT network

A novel bidirectional LSTM model for network intrusion detection in SDN-IoT network

A Network Intrusion Detection Model Based on GA-Improved NSA

With the popularization of the Internet, network security issues have also emerged. In response to network security issues, there are certain shortcomings in current network intrusion detection technologies. To improve and optimize this technology, a network intrusion detection model based on genetic algorithm and improved negative selection algorithm is designed. The generation of detectors in the selection algorithm is replaced by genetic algorithm, and the non-self spatial distribution of detectors is optimized. This paper proposes a network intrusion detection model using a genetic algorithm-improved negative selection algorithm (GA-INSA) and an improved LeNet-5 CNN. The GA enhances detector generation and distribution in NSA while SMOTE handles class imbalance for CNN. Experiments show GA-INSA has over 9% higher accuracy than NSA, SVM and GA-BP across different data sizes. The improved LeNet-5 demonstrates superior accuracy and recall rates over by over 20% baseline LeNet-5. However, more comprehensive evaluation on public datasets, design details on architectures, and discussion around limitations are warranted. The data shows that the designed network intrusion detection model has better performance. The model can provide technical support for network intrusion detection in reality and can enrich the content of network intrusion detection technology.

Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction

Cybersecurity has emerged as a critical global concern. Intrusion Detection Systems (IDS) play a critical role in protecting interconnected networks by detecting malicious actors and activities. Machine Learning (ML)-based behavior analysis within the IDS has considerable potential for detecting dynamic cyber threats, identifying abnormalities, and identifying malicious conduct within the network. However, as the number of data grows, dimension reduction becomes an increasingly difficult task when training ML models. Addressing this, our paper introduces a novel ML-based network intrusion detection model that uses Random Oversampling (RO) to address data imbalance and Stacking Feature Embedding based on clustering results, as well as Principal Component Analysis (PCA) for dimension reduction and is specifically designed for large and imbalanced datasets. This model’s performance is carefully evaluated using three cutting-edge benchmark datasets: UNSW-NB15, CIC-IDS-2017, and CIC-IDS-2018. On the UNSW-NB15 dataset, our trials show that the RF and ET models achieve accuracy rates of 99.59% and 99.95%, respectively. Furthermore, using the CIC-IDS2017 dataset, DT, RF, and ET models reach 99.99% accuracy, while DT and RF models obtain 99.94% accuracy on CIC-IDS2018. These performance results continuously outperform the state-of-art, indicating significant progress in the field of network intrusion detection. This achievement demonstrates the efficacy of the suggested methodology, which can be used practically to accurately monitor and identify network traffic intrusions, thereby blocking possible threats.

A multi-classification detection model for imbalanced data in NIDS based on reconstruction and feature matching

With the exponential growth of various data interactions on network systems, network intrusions are also increasing. The emergence of edge computing technology brings a new solution to network security. However, due to the difficulty of processing massive and unbalanced data at the edge, higher accuracy requirements are necessary for deployed detection models. This paper proposes a multi-classification model for network intrusion detection based on reconstruction and feature matching. This model can be deployed on small-scale edge nodes, effectively identifying various attack behaviors through the utilization of reconstruction errors and adaptive scaling. Furthermore, we proposed a model transfer method based on feature matching to enhance the training and detection efficiency of multi-classification models under different data distribution conditions. The proposed model has been evaluated on the CICIDS2017 dataset in terms of accuracy, recall, precision and F1 score. The model demonstrates high accuracy for normal flows in the network, majority class attacks, and minority class attacks, achieving an overall multi-class accuracy of 99.81%, outperforming similar models. Furthermore, this model demonstrates faster convergence and training speed after feature matching, exhibiting better robustness and outstanding performance at the edge.

LSTM-CNN: A Deep Learning Model for Network Intrusion Detection in Cloud Infrastructures

LSTM-CNN: A Deep Learning Model for Network Intrusion Detection in Cloud Infrastructures

A novel approach to intrusion detection using zero-shot learning hybrid partial labels

Computer networks have become the backbone of our interconnected world in today's technologically driven landscape. Unauthorized access or malicious activity carried out by threat actors to acquire control of network resources, exploit vulnerabilities, or undermine system integrity are examples of network intrusion. ZSL(Zero-Shot Learning) is a machine learning paradigm that addresses the problem of detecting and categorizing objects or concepts that were not present in the training data. . Traditional supervised learning algorithms for intrusion detection frequently struggle with insufficient labeled data and may struggle to adapt to unexpected assault patterns. In this article We have proposed a unique zero-shot learning hybrid partial label model suited to a large image-based network intrusion dataset to overcome these difficulties. The core contribution of this study is the creation and successful implementation of a novel zero-shot learning hybrid partial label model for network intrusion detection, which has a remarkable accuracy of 99.12%. The suggested system lays the groundwork for future study into other feature selection techniques and the performance of other machine learning classifiers on larger datasets. Such research can advance the state-of-the-art in intrusion detection and improve our ability to detect and prevent the network attacks. We hope that our research will spur additional research and innovation in this critical area of cybersecurity.

Modified artificial rabbits optimization combined with bottlenose dolphin optimizer in feature selection of network intrusion detection

<abstract> <p>For the feature selection of network intrusion detection, the issue of numerous redundant features arises, posing challenges in enhancing detection accuracy and adversely affecting overall performance to some extent. Artificial rabbits optimization (ARO) is capable of reducing redundant features and can be applied for the feature selection of network intrusion detection. The ARO exhibits a slow iteration speed in the exploration phase of the population and is prone to an iterative stagnation condition in the exploitation phase, which hinders its ability to deliver outstanding performance in the aforementioned problems. First, to enhance the global exploration capabilities further, the thinking of ARO incorporates the mud ring feeding strategy from the bottlenose dolphin optimizer (BDO). Simultaneously, for adjusting the exploration and exploitation phases, the ARO employs an adaptive switching mechanism. Second, to avoid the original algorithm getting trapped in the local optimum during the local exploitation phase, the levy flight strategy is adopted. Lastly, the dynamic lens-imaging strategy is introduced to enhance population variety and facilitate escape from the local optimum. Then, this paper proposes a modified ARO, namely LBARO, a hybrid algorithm that combines BDO and ARO, for feature selection in the network intrusion detection model. The LBARO is first empirically evaluated to comprehensively demonstrate the superiority of the proposed algorithm, using 8 benchmark test functions and 4 UCI datasets. Subsequently, the LBARO is integrated into the feature selection process of the network intrusion detection model for classification experimental validation. This integration is validated utilizing the NSL-KDD, UNSW NB-15, and InSDN datasets, respectively. Experimental results indicate that the proposed model based on LBARO successfully reduces redundant characteristics while enhancing the classification capabilities of network intrusion detection.</p> </abstract>

BBO-CFAT: Network Intrusion Detection Model Based on BBO Algorithm and Hierarchical Transformer

BBO-CFAT: Network Intrusion Detection Model Based on BBO Algorithm and Hierarchical Transformer

Retracted: Design of Network Intrusion Detection Model Based on TCA

Retracted: Design of Network Intrusion Detection Model Based on TCA

An Intrusion Detection Model Based on Feature Selection and Improved One-Dimensional Convolutional Neural Network

The problem of intrusion detection has new solutions, thanks to the widespread use of machine learning in the field of network security, but it still has a few issues at this time. Traditional machine learning techniques to intrusion detection rely on expert experience to choose features, and deep learning approaches have a low detection efficiency. In this paper, an intrusion detection model based on feature selection and improved one-dimensional convolutional neural network was proposed. This model first used the extreme gradient boosting decision tree (XGboost) algorithm to sort the preprocessed data, and then it used comparison to weed out 55 features with a higher contribution. Then, the extracted features were fed into the improved one-dimensional convolutional neural network (I1DCNN), and this network training was used to complete the final classification task. The feature selection and improved one-dimensional convolutional neural network (FS-I1DCNN) intrusion detection model not only solved the traditional machine learning method of relying on expert experience to extract features but also improved the detection efficiency of the model, reduced the training time while reducing the dimension, and increased the overall accuracy. In comparison to the I1DCNN model without feature extraction and the conventional one-dimensional convolutional neural network (1DCNN) model, the experimental results demonstrate that the FS-I1DCNN model’s overall accuracy increases by 0.67% and 2.94%, respectively. Its accuracy, precision, recall, and F1-score were significantly better than those of the other intrusion detection models, including SVM and DBN.

SOINN Intrusion Detection Model Based on Three-Way Attribute Reduction

With a large number of intrusion detection datasets and high feature dimensionality, the emergent nature of new attack types makes it impossible to collect network traffic data all at once. The modified three-way attribute reduction method is combined with a Self-Organizing Incremental learning Neural Network (SOINN) algorithm to propose a self-organizing incremental neural network intrusion detection model based on three-way attribute reduction. Attribute importance is used to perform attribute reduction, and the data after attribute reduction are fed into a self-organized incremental learning neural network algorithm, which generalizes the topology of the original data through self-organized competitive learning. When the streaming data are transferred into the model, the inter-class insertion or node fusion operation is performed by comparing the inter-node distance and similarity threshold to achieve incremental learning of the model streaming data. The inter-node distance value is introduced into the weight update formulation to replace the traditional learning rate and to optimize the topological structure adjustment operation. The experimental results show that T-SOINN achieves high precision and recall when processing intrusion detection data.

Federated deep learning algorithm for RPA network security detection

ABSTRACT The development of Internet technology has produced a huge impact on people’s lives. More data information is generated in life or work. Research proposes a combined detection model, and combines Fed Prox, convolutional neural network, and support vector machine to obtain Fed Prox Convolutional Neural Networks Support Vector Machine (Fed PCNN). The network intrusion detection model trains the local model with the divided local data, uses the model with the near-end item as the judgment basis, analyzes the difference between the model and the global model, and then trains the local model through local iteration. Finally, the local model is aggregated to obtain the best classification prediction effect of the model effect. The research proves that the Fed PCNN model has an excellent performance in recall and accuracy through experiments. In different data sets, the recall rate is more than 90%, the accuracy rate is more than 95%, and the false alarm rate is less than 2%. Therefore, the Fed PCNN model has a good detection effect in network intrusion detection.

Intrusion detection for Industrial Internet of Things based on deep learning

Intrusion detection technology can actively detect abnormal behaviors in the network and is important to the security of Industrial Internet of Things (IIOT). However, there are some issues with the current intrusion detection technology for IIOT, such as extreme imbalance in the number of samples of different classes in the dataset, redundant and meaningless features in the samples, and the inability of traditional intrusion detection methods to meet the requirements of detection accuracy in the increasingly complex IIOT. In view of the extreme imbalance of classes, this paper applies the hierarchical clustering algorithm to the under-sampling technology, which reduces the number of majority samples while reducing the loss of information of majority samples, and solves the problem of missing detection and false detection of minority samples caused by sample imbalance. In order to avoid feature redundancy and interference, this paper proposes an optimal feature selection algorithm based on greedy thought. This algorithm can obtain the optimal feature subset of each type of data in the data set, thus eliminating redundant and interfering features. Aiming at the problem of insufficient detection ability of traditional detection methods, this paper proposes a deep neural network intrusion detection model based on the parallel connection of global and local subnetworks. This model obtains the overall benchmark detection of the dataset through the deep neural network, and then strengthens the detection effect of each subclass through the parallel connection of subnetworks, greatly improving the performance of the intrusion detection algorithm. The experimental results show that the method described in this paper can improve the intrusion detection for IIOT.

A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism

A network intrusion detection tool can identify and detect potential malicious activities or attacks by monitoring network traffic and system logs. The data within intrusion detection networks possesses characteristics that include a high degree of feature dimension and an unbalanced distribution across categories. Currently, the actual detection accuracy of some detection models is relatively low. To solve these problems, we propose a network intrusion detection model based on multi-head attention and BiLSTM (Bidirectional Long Short-Term Memory), which can introduce different attention weights for each vector in the feature vector that strengthen the relationship between some vectors and the detection attack type. The model also utilizes the advantage that BiLSTM can capture long-distance dependency relationships to obtain a higher detection accuracy. This model combined the advantages of the two models, adding a dropout layer between the two models to improve the detection accuracy while preventing training overfitting. Through experimental analysis, the network intrusion detection model that utilizes multi-head attention and BilSTM achieved an accuracy of 98.29%, 95.19%, and 99.08% on the KDDCUP99, NSLKDD, and CICIDS2017 datasets, respectively.

A Hypertuned Lightweight and Scalable LSTM Model for Hybrid Network Intrusion Detection

Given the increasing frequency of network attacks, there is an urgent need for more effective network security measures. While traditional approaches such as firewalls and data encryption have been implemented, there is still room for improvement in their effectiveness. To effectively address this concern, it is essential to integrate Artificial Intelligence (AI)-based solutions into historical methods. However, AI-driven approaches often encounter challenges, including lower detection rates and the complexity of feature engineering requirements. Finding solutions to overcome these hurdles is critical for enhancing the effectiveness of intrusion detection systems. This research paper introduces a deep learning-based approach for network intrusion detection to overcome these challenges. The proposed approach utilizes various classification algorithms, including the AutoEncoder (AE), Long-short-term-memory (LSTM), Multi-Layer Perceptron (MLP), Linear Support Vector Machine (L-SVM), Quantum Support Vector Machine (Q-SVM), Linear Discriminant Analysis (LDA), and Quadratic Discriminant Analysis (QDA). To validate the effectiveness of the proposed approach, three datasets, namely IOT23, CICIDS2017, and NSL KDD, are used for experimentation. The results demonstrate impressive accuracy, particularly with the LSTM algorithm, achieving a 97.7% accuracy rate on the NSL KDD dataset, 99% accuracy rate on the CICIDS2017 dataset, and 98.7% accuracy on the IOT23 dataset. These findings highlight the potential of deep learning algorithms in enhancing network intrusion detection. By providing network administrators with robust security measures for accurate and timely intrusion detection, the proposed approach contributes to network safety and helps mitigate the impact of network attacks.

A multimodal hybrid parallel network intrusion detection model

With the rapid growth of Internet data traffic, the means of malicious attack become more diversified. The single modal intrusion detection model cannot fully exploit the rich feature information in the massive network traffic data, resulting in unsatisfactory detection results. To address this issue, this paper proposes a multimodal hybrid parallel network intrusion detection model (MHPN). The proposed model extracts network traffic features from two modalities: the statistical information of network traffic and the original load of traffic, and constructs appropriate neural network models for each modal information. Firstly, a two-branch convolutional neural network is combined with Long Short-Term Memory (LSTM) network to extract the spatio-temporal feature information of network traffic from the original load mode of traffic, and a convolutional neural network is used to extract the feature information of traffic statistics. Then, the feature information extracted from the two modalities is fused and fed to the CosMargin classifier for network traffic classification. The experimental results on the ISCX-IDS 2012 and CIC-IDS-2017 datasets show that the MHPN model outperforms the single-modal models and achieves an average accuracy of 99.98 % . The model also demonstrates strong robustness and a positive sample recognition rate.

Remora based Deep Maxout Network model for network intrusion detection using Convolutional Neural Network features

With the rapid evolution of the Internet of Things (IoT), network advancement has significantly influenced the increasing number of devices and advanced enhancements linked with it. Indeed the increasing number prevalence and sophistication of emerging cyber-attacks have highlighted the necessity for designing robust security application. In this paper, the Remora-based Deep Maxout Network model is Proposed. Here, the input data is acquired and forwarded to the pre-processing phase, wherein the missing value imputation approach is employed for creating a complete dataset. Later, the pre-processed data is then subjected to dimension transformation from the transformed data; the Convolutional Neural Network features are extracted, followed by feature selection based on Canberra distance. Here, detection is carried out using a Deep Maxout Network whose weights and training parameters are modified using the Remora Optimization Algorithm. However, the proposed model has delivered superior results with a high testing accuracy of 0.945

TGA: A Novel Network Intrusion Detection Method Based on TCN, BiGRU and Attention Mechanism

With the increasing complexity of the network environment, the types of network attacks are gradually increasing. Network intrusion detection systems can detect and identify network attacks effectively. However, the existing methods have some limitations, focusing only on local or global temporal features of network traffic. To address the above issues, we present a novel network intrusion detection model (TGA) based on Temporal Convolutional Network (TCN), Bidirectional Gated Recurrent Unit (BiGRU), and self-attention mechanism. TCN extracts local temporal information from network traffic sequences, while BiGRU extracts global temporal information from network traffic sequences. However, TCN and BiGRU do not consider the weights of features when extracting them, so an attention mechanism is added. The feature vectors obtained in TCN and BiGRU are fused and then input into the self-attention mechanism to capture the correlation between different positions in the sequence and reassign the weights of the temporal features to further enhance the model’s capabilities. Lastly, it is delivered to the classifier to classify different network traffic classes. Our method achieves 97.83% accuracy on the public CSE-CIC-IDS2018 dataset. After extensive experiments, our idea proved to be reasonable and practical.

An Effective Network Intrusion Detection Model for Coarse-to-Fine Attack Classification of Imbalanced Network Traffic

An Effective Network Intrusion Detection Model for Coarse-to-Fine Attack Classification of Imbalanced Network Traffic

Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection

Traditional firewalls and data encryption techniques can no longer match the demands of current IoT network security due to the rising amount and variety of network threats. In order to manage IoT network risks, intrusion detection solutions have been advised. Even though machine learning (ML) helps the widely used intrusion detection techniques currently in use, these algorithms struggle with low detection rates and the requirement for extensive feature engineering. The deep learning model for IoT network intrusion detection is a method for traffic anomaly detection that is suggested by this study. To extract the sequence properties of data flow through a CNN, it combines an attention mechanism with a Long Short Term Memory (LSTM) network. This method uses adaptive synthetic sampling (ADASYN) to increase the size of minority-class samples. The proposed models demonstrated acceptable precision and recall for each class when used for binary-class classification, proving their stability and capacity to identify all classes correctly. The MLP classifier’s accuracy, precision, recall, and F1 value were 87%, 89%, 87%, and 89%, respectively, with an AUC score of 0.88. Overall, the proposed models performed well. The attack and all-class models exhibited good AUCs and macro metrics, the same as the proposed MLP classifier, which had an F1 score of 83% and an AUC score of 0.94. Additionally, it trained the MLP classifier and integrated the ADAM optimizer and category cross-entropy loss function for all-class classification. With an AUC value of 94%, it possessed 84% accuracy, 87% precision, 84% recall, and an 83% F1 score. A further indication of the hybrid model’s ability to combine the benefits of both models to improve overall performance was that it regularly outperformed the MLP model. This model’s accuracy and F1 score are better than those of earlier comparable algorithms, according to experimental results using the publicly accessible benchmark dataset for network intrusion detection (NSL–KDD).