Network Intrusion Detection Model Research Articles

A tree classifier based network intrusion detection model for Internet of Medical Things

Healthcare is one of the key areas of prospect for the Internet of Things (IoT). To facilitate better medical services, enormous growth in the field of the Internet of Medical Things (IoMT) is observed recently. Despite the numerous benefits, the cyber threats on connected healthcare devices can compromise privacy and can also cause damage to the health of the concerned patient. The massive demand for IoMT devices with seamless and effective medical facilities for the large-scale population requires a robust secured model to ensure the privacy and safety of patients in this network. However, designing security models for IoMT networks is very challenging. An effort has been made in this work, to design a tree classifier-based network intrusion detection model for IoMT networks. The proposed system effectively reduces the dimension of the input data to speed up the anomaly detection procedure while maintaining a very high accuracy of 94.23%.

Intrusion Detection System After Data Augmentation Schemes Based on the VAE and CVAE

Industrial Internet of Things (IoT) is the most rapidly developing industry in the current IoT industry, and the intrusion detection system (IDS) remains one of the key technologies for industrial IoT security protection. Researchers have considered applying algorithms such as machine learning and deep learning to network IDSs to cope with complex and changing network environments and to automatically extract key features from high-dimensional feature data. However, in the real industrial IoT environment, data imbalance is the main factor that affects the performance of the deep-learning-based IDS. In this article, we study the network intrusion detection model based on data level. Three data-based research schemes are constructed step by step in this article, which are a data augmentation scheme based on the variational autoencoder (VAE), a data-balancing scheme based on the conditional VAE, and a data-balancing scheme based on random undersampling and conditional VAE. The three data-level-based schemes are combined with the deep-learning-based IDS. In this article, we build experiments based on the CSE-CIC-IDS2018 dataset to verify the effectiveness of three data processing schemes. After data enhancement through the third scheme, the Macro-F1-score of the convolutional-neural-network-based IDS model improved by 3.75% and the Macro-F1-score of the gated-recurrent-unit-based IDS model improved by 5.32%.

MFVT: an anomaly traffic detection method merging feature fusion network and vision transformer architecture

Network intrusion detection, which takes the extraction and analysis of network traffic features as the main method, plays a vital role in network security protection. The current network traffic feature extraction and analysis for network intrusion detection mostly uses deep learning algorithms. Currently, deep learning requires a lot of training resources and has weak processing capabilities for imbalanced datasets. In this paper, a deep learning model (MFVT) based on feature fusion network and vision transformer architecture is proposed, which improves the processing ability of imbalanced datasets and reduces the sample data resources needed for training. Besides, to improve the traditional raw traffic features extraction methods, a new raw traffic features extraction method (CRP) is proposed, and the CPR uses PCA algorithm to reduce all the processed digital traffic features to the specified dimension. On the IDS 2017 dataset and the IDS 2012 dataset, the ablation experiments show that the performance of the proposed MFVT model is significantly better than other network intrusion detection models, and the detection accuracy can reach the state-of-the-art level. And, when MFVT model is combined with CRP algorithm, the detection accuracy is further improved to 99.99%.

Network Intrusion Detection Model Based on CNN and GRU

A network intrusion detection model that fuses a convolutional neural network and a gated recurrent unit is proposed to address the problems associated with the low accuracy of existing intrusion detection models for the multiple classification of intrusions and low accuracy of class imbalance data detection. In this model, a hybrid sampling algorithm combining Adaptive Synthetic Sampling (ADASYN) and Repeated Edited nearest neighbors (RENN) is used for sample processing to solve the problem of positive and negative sample imbalance in the original dataset. The feature selection is carried out by combining Random Forest algorithm and Pearson correlation analysis to solve the problem of feature redundancy. Then, the spatial features are extracted by using a convolutional neural network, and further extracted by fusing Averagepooling and Maxpooling, using attention mechanism to assign different weights to the features, thus reducing the overhead and improving the model performance. At the same time, a Gated Recurrent Unit (GRU) is used to extract the long-distance dependent information features to achieve comprehensive and effective feature learning. Finally, a softmax function is used for classification. The proposed intrusion detection model is evaluated based on the UNSW_NB15, NSL-KDD, and CIC-IDS2017 datasets, and the experimental results show that the classification accuracy reaches 86.25%, 99.69%, 99.65%, which are 1.95%, 0.47% and 0.12% higher than that of the same type of CNN-GRU, and can solve the problems of low classification accuracy and class imbalance well.

Network Intrusion Detection Method Based on FCWGAN and BiLSTM.

Imbalanced datasets greatly affect the analysis capability of intrusion detection models, biasing their classification results toward normal behavior and leading to high false-positive and false-negative rates. To alleviate the impact of class imbalance on the detection accuracy of network intrusion detection models and improve their effectiveness, this paper proposes a method based on a feature selection-conditional Wasserstein generative adversarial network (FCWGAN) and bidirectional long short-term memory network (BiLSTM). The method uses the XGBoost algorithm with Spearman's correlation coefficient to select the data features, filters out useless and redundant features, and simplifies the data structure. A conditional WGAN (CWGAN) is used to generate a small number of samples in the dataset, add them to the original training set to supplement the dataset samples, and apply BiLSTM to complete the training of the model and realize the classification. In comparative tests based on the NSL-KDD and UNSW-NB15 datasets, the accuracy of the proposed model reached 99.57% and 85.59%, respectively, which is 1.44% and 2.98% higher than that of the same type of CWGAN and deep neural network (CWGAN-DNN) model, respectively.

Network Intrusion Detection Technology Based on Convolutional Neural Network and BiGRU.

To solve the problem of low accuracy and high false-alarm rate of existing intrusion detection models for multiple classifications of intrusion behaviors, a network intrusion detection model incorporating convolutional neural network and bidirectional gated recurrent unit is proposed. To solve the problems of many dimensions of features and imbalance of positive and negative samples in the original traffic data, sampling processing is performed with the help of a hybrid sampling algorithm combining ADASYN and RENN, and feature selection is performed by combining random forest algorithm and Pearson correlation analysis; after that, spatial features are extracted by the convolutional neural network, and further features are extracted by incorporating average pooling and max pooling, and then BiGRU is used to extracts long-distance dependent information features to achieve comprehensive and effective feature learning. Finally, the Softmax function is used for classification. In this paper, the proposed model is evaluated on the UNSW_NB15, NSL-KDD, and CIC-IDS2017 data sets with an accuracy of 85.55%, 99.81%, and 99.70%, which is 1.25%, 0.59%, and 0.27% better than the same type model of CNN-GRU.

ROULETTE: A neural attention multi-output model for explainable Network Intrusion Detection

Network Intrusion Detection (NID) systems are one of the most powerful forms of defense for protecting public and private networks. Most of the prominent methods applied to NID problems consist of Deep Learning methods that have achieved outstanding accuracy performance. However, even though they are effective, these systems are still too complex to interpret and explain. In recent years this lack of interpretability and explainability has begun to be a major drawback of deep neural models, even in NID applications. With the aim of filling this gap, we propose ROULETTE: a method based on a new neural model with attention for an accurate, explainable multi-class classification of network traffic data. In particular, attention is coupled with a multi-output Deep Learning strategy that helps to discriminate better between network intrusion categories. We report the results of extensive experimentation on two benchmark datasets, namely NSL-KDD and UNSW-NB15, which show the beneficial effects of the proposed attention mechanism and multi-output learning strategy on both the accuracy and explainability of the decisions made by the method.

Resilient Back Propagation Neural Network Security Model For Containerized Cloud Computing

Cloud-native computing is getting more and more popular in recent years where containerized microservices architectural designs play a central role in building a distributed systems and services. On one hand, they bring convenience and simplicity to build massively scalable distributed cloud-native applications and enable continuous development and delivery for their services. On the other hand, they widen the surface of malicious intrusions, which, in turn, without proper defense mechanisms, lessens their benefits to a certain degree. Among the biggest threats of malicious intrusions are those that belong to the Distributed Denial of Service (DDoS) family. Such type of attacks are challenging because DDoS attacks are elevated hard-to-absorbed threats and have a high degree of variability in types, design, and complexity. In this work, resilient backpropagation neural network was used to build an intelligent network intrusion detection model against the most modernistic DDoS attacks in the cloud-native computing environment. We evaluated our proposed model using the benchmarking Canadian Institute for Cybersecurity evaluation CICDDoS 2019 dataset. Our proposed detection model has achieved high reflective DDoS attack detection. Therefore, it is appropriate to defend against reflective DDoS attacks in containerized cloud-native platforms. Experimental results indicate that the DDoS attack detection accuracy of the proposed resilient neural network model is as high as 97.07% which outperforms most of the well-known learning models mentioned in the most related work. Moreover, the proposed model has achieved a competitive run time performance that highly meets the delay requirements of containerized cloud computing.

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

With an increase in the number and types of network attacks, traditional firewalls and data encryption methods can no longer meet the needs of current network security. As a result, intrusion detection systems have been proposed to deal with network threats. The current mainstream intrusion detection algorithms are aided with machine learning but have problems of low detection rates and the need for extensive feature engineering. To address the issue of low detection accuracy, this paper proposes a model for traffic anomaly detection named a deep learning model for network intrusion detection (DLNID), which combines an attention mechanism and the bidirectional long short-term memory (Bi-LSTM) network, first extracting sequence features of data traffic through a convolutional neural network (CNN) network, then reassigning the weights of each channel through the attention mechanism, and finally using Bi-LSTM to learn the network of sequence features. In intrusion detection public data sets, there are serious imbalance data generally. To address data imbalance issues, this paper employs the method of adaptive synthetic sampling (ADASYN) for sample expansion of minority class samples, to eventually form a relatively symmetric dataset, and uses a modified stacked autoencoder for data dimensionality reduction with the objective of enhancing information fusion. DLNID is an end-to-end model, so it does not need to undergo the process of manual feature extraction. After being tested on the public benchmark dataset on network intrusion detection NSL-KDD, experimental results show that the accuracy and F1 score of this model are better than those of other comparison methods, reaching 90.73% and 89.65%, respectively.

Computer Network Intrusion Anomaly Detection with Recurrent Neural Network

Network intrusion anomaly detection technique has been widely employed in computer network environments as a highly effective security prevention method. As network technology and network applications have advanced at a rapid pace, so too has network data traffic, resulting in an increase in virus and attack kinds. In the face of large-scale traffic and characteristic information, traditional intrusion detection will have problems such as low detection accuracy, high false negatives, and reliance on dimensionality reduction algorithms. Therefore, it is particularly important to establish a fast and efficient network intrusion anomaly detection method to deal with the current complex network environment. This work designs a computer network intrusion detection model with a recurrent neural network in order to explore a new intrusion detection method. The main purpose of this article include the following: (1) design a network security emergency response system architecture with the recurrent neural network model. This system consists of a management center module, a knowledge database module, a data acquisition module, a risk detection tool module, a risk analysis and processing module, a data protection module, and a remote connection auxiliary module. The modules cooperate with each other to complete system functions. (2) Aiming at the risk analysis and processing module, a network intrusion detection model combining bidirectional long short-term memory (BiLSTM) and deep neural network (DNN) is designed. In view of the lack of consideration of the before-and-after relevance of intrusion data features and the multifeature problem in existing models, the use of BiLSTM to extract the relevance between features and the use of DNN to extract deeper features are proposed. Aiming at the problem that the model lacks consideration of the importance of features, it is proposed to embed an attention mechanism into the network to increase consideration for the importance of features. (3) Massive experiments have verified the reliability and effectiveness of the method proposed in this work.

Internet of things network intrusion detection model based on quantum artificial fish group and fuzzy kernel clustering algorithm

AbstractThe application of internet of things (IoT) devices in 5G/B5G has benefited many industries, such as automated production, smart agriculture and autopilot, and has provided access to billions of smart devices. However, the rapid growth of IoT devices has also brought network security issues. The purpose of this paper is to study the network intrusion detection model based on quantum artificial fish population and fuzzy kernel clustering algorithm. In this paper, the network intrusion detection model based on traditional fuzzy C‐means (FCM) clustering has poor classification effect and is prone to local extremum. A semi‐supervised fuzzy kernel–clustering algorithm based on quantum artificial fish group is proposed. The algorithm adopts a small amount of tag data and many unknown tag data to generate the classification of network intrusion detection and constructs a new objective function of FCM algorithm by means of kernel distance. In the simulation experiment of KDD Cup 99 network intrusion detection data, compared with the intrusion detection model based on FCM, particle swarm optimization‐FCM, the detection rate of the proposed algorithm in the known attack and unknown attack is 92.5% and 84.9%, respectively. The results show that the proposed intrusion detection algorithm has better detection rate.

TCAN-IDS: Intrusion Detection System for Internet of Vehicle Using Temporal Convolutional Attention Network

Intrusion detection systems based on recurrent neural network (RNN) have been considered as one of the effective methods to detect time-series data of in-vehicle networks. However, building a model for each arbitration bit is not only complex in structure but also has high computational overhead. Convolutional neural network (CNN) has always performed excellently in processing images, but they have recently shown great performance in learning features of normal and attack traffic by constructing message matrices in such a manner as to achieve real-time monitoring but suffer from the problem of temporal relationships in context and inadequate feature representation in key regions. Therefore, this paper proposes a temporal convolutional network with global attention to construct an in-vehicle network intrusion detection model, called TCAN-IDS. Specifically, the TCAN-IDS model continuously encodes 19-bit features consisting of an arbitration bit and data field of the original message into a message matrix, which is symmetric to messages recalling a historical moment. Thereafter, the feature extraction model extracts its spatial-temporal detail features. Notably, global attention enables global critical region attention based on channel and spatial feature coefficients, thus ignoring unimportant byte changes. Finally, anomalous traffic is monitored by a two-class classification component. Experiments show that TCAN-IDS demonstrates high detection performance on publicly known attack datasets and is able to accomplish real-time monitoring. In particular, it is anticipated to provide a high level of symmetry between information security and illegal intrusion.

A Predictive Model for Network Intrusion Detection System Using Deep Neural Network

Network Intrusion Detection System (NIDS) is an important part of Cyber safety and security. It plays a key role in all networked ICT systems in detecting rampant attacks such as Denial of Service (DoS) and ransom ware attacks. Existing methods are inadequate in terms of accuracy detection of attacks. However, the requirement for high accuracy detection of attacks using Deep Neural Network requires expensive computing resources which in turn make most organisations, and individuals shy away from it. This study therefore aims at designing a predictive model for network intrusion detection using deep neural networks with very limited computing resources. The study adopted Cross Industry Standard Process for Data Mining (CRISP-DM) as one of the formal methodologies and python was used for both testing and training, using crucial parameters such as the learning rate, number of epochs, neurons and hidden layers which greatly determined the accuracy level of the DNN algorithm. These parameters were experimented with values that are lesser compared to previous studies, training and evaluation were also done on the KDD99 data-set. The varying values of accuracy obtained from this study on four models with different numbers of layers of 50-epochs and learning rate of 0.01 achieved competitive results in comparison with the previous research of 100-1000 epochs and learning rate of 0.1. Therefore, the model with two layers attained same accuracy of 0.955 as the model with three layers from the previous study out of the four models tested in this study.
 Also, the models with three and four layers in this study attained an accuracy of 0.956, which is 0.001greater than the previous study's models.
 Keywords: Network-Based IDS, Host-Based IDS, Deep Neural Network, Denial of Service, Knowledge Discovery Dataset

Network Intrusion Detection with Nonsymmetric Deep Autoencoding Feature Extraction

To address the problems of high reconstruction error and long training time when using Stack Nonsymmetric Deep Autoencoder (SNDAE) feature extraction technology for intrusion detection, Adam Nonsymmetric Deep Autoencoder (ANDAE) is proposed based on SNDAE. The Adam optimization algorithm is used to update network parameters during training so that the loss function can quickly converge to the ideal value. Under the premise of not affecting the effect of feature extraction, the network structure is simplified, and the training time of the network is reduced to realize the efficient extraction of the rapid growth of high-dimension and nonlinear network traffic features. For the low-dimensional prominent features extracted by ANDAE, Random Forest is used for classification to detect intrusion action, and a network intrusion detection model based on ANDAE feature extraction is implemented. The experimental results on the NSL-KDD and the CIC-IDS2017 datasets show that, compared to the SNDAE-based intrusion detection model, the ANDAE model has an average increase of 6.78% in accuracy, an average of 13.06% in recall, and an average of 14.9% in F1 scores. Feature extraction time is reduced by 23.1% on average. Thus, the ANDAE model is an intrusion detection solution, which can simultaneously improve detection accuracy and time efficiency.

A bio-inspired hybrid deep learning model for network intrusion detection

Advances in network communications have resulted in an explosion of connected device usages in several business domains with phenomenal surge in network traffic. Though the capabilities of the business models are empowered with Internet driven service providers, they are vulnerable to severe security threats. Intrusion detection systems capable of identifying malicious attacks from traffic data are potential tools in securing organizational resources from unauthorized access. This paper proposes an intrusion detection system modeled as a two stage framework with feature selection performed by a Generalized Mean Grey Wolf Algorithm and an ElasticNet Contractive Auto Encoder. It is tested with the NSL-KDD and BoT-IoT datasets resulting in an overall classification accuracy of 0.999 for binary and multi-class classification of attacks. This system performs classification with an optimal subset of traffic features and surpasses the performances of state-of-the-art intrusion detection systems. Further, the proposed model also demonstrates its effectiveness to learn from unlabeled data without additional training, signal drifts from normal data and generalization with arbitrary test data.

A System to automate the development of anomaly-based network intrusion detection model

Cyber security is the major concern in today’s world. Over the past couple of decades, the internet has grown to such an extent that almost every individual living on this planet has the access to the internet today. This can be viewed as one of the major achievements in the human race, but on the flip side of the coin, this gave rise to a lot of security issues for every individual or the company that is accessing the web through the internet. Hackers have become active and are always monitoring the networks to grab every possible opportunity to attack a system and make the best fortune out of its vulnerabilities. To safeguard people’s and organization’s privacy in this cyberspace, different network intrusion detection systems have been developed to detect the hacker’s presence in the networks. These systems fall under signature based and anomaly based intrusion detection systems. This paper deals with using anomaly based intrusion detection technique to develop an automation system to both train and test supervised machine learning models, which is developed to classify real time network traffic as to whether it is malicious or not. Currently the best models by considering both detection success rate and the false positives rate are Artificial Neural Networks(ANN) followed by Support Vector Machines(SVM). In this paper, it is verified that Artificial Neural Network (ANN) based machine learning with wrapper feature selection outperforms support vector machine (SVM) technique while classifying network traffic as harmful or harmless. Initially to evaluate the performance of the system, NSL-KDD dataset is used to train and test the SVM and ANN models and finally classify real time network traffic using these models. This system can be used to carry out model building automatically on the new datasets and also for classifying the behaviour of the provided dataset without having to code.

Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning

The combination of deep learning and intrusion detection has become a hot topic in today’s network security. In the face of massive, high-dimensional network traffic with uneven sample distribution, how to be able to accurately detect anomalous traffic is the primary task of intrusion detection. Most research on intrusion detection systems based on network anomalous traffic detection has focused on supervised learning; however, the process of obtaining labeled data often requires a lot of time and effort, as well as the support of network experts. Therefore, it is worthwhile investigating the development of label-free self-supervised learning-based approaches called BYOL which is a simple and elegant framework with sufficiently powerful feature extraction capabilities for intrusion detection systems. In this paper, we propose a new data augmentation strategy for intrusion detection data and an intrusion detection model based on label-free self-supervised learning, using a new data augmentation strategy to introduce a perturbation enhancement model to learn invariant feature representation capability and an improved BYOL self-supervised learning method to train the UNSW-NB15 intrusion detection dataset without labels to extract network traffic feature representations. Linear evaluation on UNSW-NB15 and transfer learning on NSK-KDD, KDD CUP99, CIC IDS2017, and CIDDS_001 achieve excellent performance in all metrics.

Modelling and Evaluation of Network Intrusion Detection Systems Using Machine Learning Techniques

This study aims at modelling and evaluating the performance of machine learning techniques on a recent network intrusion dataset. Five machine learning algorithms, which include k-nearest neighbour (KNN), support vector machines (SVM), voting ensemble, random forest, and XGBoost, have been utilized in the development of the network intrusion detection models. The proposed models are tested using the UNSW_NB15 dataset. Three different K values are used for model with KNN algorithm and two different kernels are utilized in the development of the model with SVM. The best detection accuracy of the model developed with KNN was 84.9% with a K value of 9; the SVM model with the best accuracy is developed with the Gaussian kernel and obtained an accuracy of 83%, and the Voting Ensemble achieved 83.4% accuracy. Random forest model achieved accuracies of 90.2% and 70.8% for binary classification and multiclass classification respectively. Finally, XGBoost model also achieves accuracies of 85% and 51.77% for binary and multiclass classification respectively.

Comprehensive Examination of Network Intrusion Detection Models on Data Science

The increased requirement of data science in recent times has given rise to the concept of data security, which has become a major issue; thus, the amalgamation of data science methodology with intrusion detection systems as a field of research has acquired a lot of prominence. The level of access to the information system and its visibility to user pursuit was required to operate securely. Intrusion detection has been gaining popularity in the area of data science to incorporate the overall information security infrastructure, where regular operations depend upon shared use of information. The problems are to build an intrusion detection system efficient enough for detecting attacks and to reduce the false positives with a high detection rate. In this paper, the authors analyse various techniques of intrusion detection combined with data science, which will help in understanding the best fit technique under different circumstances.

Intrusion Detecting System Based on Temporal Convolutional Network for In-Vehicle CAN Networks

In recent years, deep learning theories, such as Recurrent Neural Networks (RNN) and Convolutional Neural Networks (CNN), have been applied as effective methods for intrusion detection in the vehicle CAN network. However, the existing RNNs realize detection by establishing independent models for each CAN ID, which are unable to learn the potential characteristics of different IDs well, and have relatively complicated model structure and high calculation time cost. CNNs can achieve rapid detection by learning the characteristics of normal and attack CAN ID sequences and exhibit good performance, but the current methods do not locate abnormal points in the sequence. To solve the above problems, this paper proposes an in-vehicle CAN network intrusion detection model based on Temporal Convolutional Network, which is called Temporal Convolutional Network-Based Intrusion Detection System (TCNIDS). In TCNIDS, the CAN ID is serialized into a natural language sequence and a word vector is constructed for each CAN ID through the word embedding coding method to reduce the data dimension. At the same time, TCNIDS uses the parameterized Relu method to improve the temporal convolutional network, which can better learn the potential features of the normal sequence. The TCNIDS model has a simple structure and realizes the point anomaly detection at the message level by predicting the future sequence of normal CAN data and setting the probability strategy. The experimental results show that the overall detection rate, false alarm rate, and accuracy rate of TCNIDS under fuzzy attack, spoofing attack, and DoS attack are higher than those of the traditional temporal convolutional network intrusion detection model.