Network Intrusion Detection Problem Research Articles

Network intrusion detection based on the temporal convolutional model

Recurrent networks have been adopted as default architecture in approaches performing sequence modelling of network intrusion detection problems. However, models based on Recurrent Neural Network (RNN) architecture have some limitations regarding computation complexity and detection performance due to information loss. Recent studies suggested that certain convolutional-based architectures that can natively process temporal data outperform recurrent networks in time series modelling, such as speech synthesis and machine translation. Inspired by the success of temporal-based convolutional architectures in other domains, this paper designs and implements four temporal-based convolutional models in network intrusion detection and studies their classification performance. The models are based on MINImally RandOm Convolutional KErnel Transform (MiniRocket), eXplainable Convolutional Neural Network for Multivariate Time Series Classification (XCM), One-Dimensional Convolution Neural Network (OS-CNN), and Time Series Transformer (TST) architecture. We evaluate our models using the effectiveness and efficiency metrics based on CICDDoS2019 and CSE-CIC-IDS2018 datasets. Every model has achieved a high evaluation performance in the range between 98.07% and 99.99% in most considered metrics using the test dataset. MiniRocket and OS-CNN obtained the highest evaluation results regarding the effectiveness metrics. The high evaluation results suggest that they can improve the detection effectiveness of approaches formulating network intrusion detection as a time series task.

Effective Intrusion Detection System Using Classifier Ensembles

The problem of network intrusion detection poses innumerable challenges to the research community, industry, and commercial sectors. Moreover, the persistent attacks occurring on the cyber-threat landscape compel researchers to devise robust approaches in order to address the recurring problem. Given the presence of huge web traffic, standard machine learning approaches are rather inefficient if adapted in network intrusion detection areas. Instead, a hybrid multiple classifier model when attempted enhances the performance henceforth leading to valid predictions. Thus, novel ensemble approaches are presented in this research work that involves bagged homogeneous classifier ensembles and arcing of heterogeneous ensembles. Then the classification performances of classifier models are assessed using accuracy. Here, classifier ensemble is built using base classifiers such as RBF and SVM. The feasibleness and the advantages of the proposed approaches are illustrated with the help of existing intrusion detection dataset. pre-processing phase, classification phase and combining phase are the three major phases of this proposed method. A broad series of analogous experiments are done for standard dataset of intrusion detection. Furthermore, comparisons with previous work on standard dataset of intrusion detection are also exhibited. The experimental outcomes demonstrate that this proposed ensemble approaches are competitive.

An intelligent and efficient network intrusion detection system using deep learning

With continuously escalating threats and attacks, accurate and timely intrusion detection in communication networks is challenging. Many approaches have already been proposed recently on network intrusion detection. However, they face critical challenges due to the continuous increase of new threats that current systems do not understand. Motivated by the outstanding performance of deep learning (DL) in many detection and recognition tasks, we introduce an intelligent and efficient network intrusion detection system (NIDS) based on DL. This study proposes a non-symmetric deep auto-encoder for network intrusion detection problems and presents its detailed functionality and performance. We validate the robustness and effectiveness of the proposed NIDS using a benchmark dataset, i.e., KDD CUP'99. Our DL-based method is implemented in the TensorFlow library and GPU framework, and it achieves an accuracy of 99.65%. The proposed system can be used in network security research domains and DL-based detection and classification systems.

Nearest cluster-based intrusion detection through convolutional neural networks

The recent boom in deep learning has revealed that the application of deep neural networks is a valuable way to address network intrusion detection problems. This paper presents a novel deep learning methodology that uses convolutional neural networks (CNNs) to equip a computer network with an effective means to analyse traffic on the network for signs of malicious activity. The basic idea is to represent network flows as 2D images and use this imagery representation of the flows to train a 2D CNN architecture. The novelty consists in deriving an imagery representation of the network flows through performing a combination of the nearest neighbour search and the clustering process. The advantage is that the proposed data mapping method allows us to build imagery data that express potential data patterns arising at neighbouring flows. The proposed methodology leads to better predictive accuracy when compared to competitive intrusion detection architectures on three benchmark datasets.

A New Intrusion Detection System Using the Improved Dendritic Cell Algorithm

Abstract The dendritic cell algorithm (DCA) as one of the emerging evolutionary algorithms is based on the behavior of the specific immune agents, known as dendritic cells (DCs). DCA has several potentially beneficial features for binary classification problems. In this paper, we aim at providing a new version of this immune-inspired mechanism acts as a semi-supervised classifier, which can be a defensive shield in network intrusion detection problem. Till now, no strategy or idea has been adopted on the $Get_{Antigen()}$ function on the detection phase, but random sampling entails the DCA to provide undesirable results in several cycles at each time. This leads to uncertainty. Whereas it must be accomplished by biological behaviors of DCs in peripheral tissues, we have proposed a novel strategy that exactly acts based on its immunological functionalities of dendritic cells. The proposed mechanism focuses on two items: first, to obviate the challenge of needing to have a preordered antigen set for computing danger signal, and the second, to provide a novel immune-inspired idea for nonrandom data sampling. A variable functional migration threshold is also computed cycle by cycle that shows the necessity of the migration threshold flexibility. A significant criterion so-called capability of intrusion detection (CID) is used for tests. All the tests have been performed in a new benchmark dataset named UNSW-NB15. Experimental consequences demonstrate that the present schema as the best version among improved DC algorithms achieves 76.69% CID by 90% accuracy and outperforms its counterpart methods.

A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets

The problem of network intrusion detection poses innumerable challenges to the research community, industry, and commercial sectors. Moreover, the persistent attacks occurring on the cyber-threat landscape compel researchers to devise robust approaches in order to address the recurring problem. Given the presence of massive network traffic, conventional machine learning algorithms when applied in the field of network intrusion detection are quite ineffective. Instead, a hybrid multimodel solution when sought improves performance thereby producing reliable predictions. Therefore, this article presents an ensemble model using metaclassification approach enabled by stacked generalization. Two contemporary as well as heterogeneous datasets, namely, UNSW NB-15, a packet-based dataset, and UGR’16, a flow-based dataset, that were captured in emulated as well as real network traffic environment, respectively, were used for experimentation. Empirical results indicate that the proposed stacking ensemble is capable of generating superior predictions with respect to a real-time dataset (97% accuracy) than an emulated one (94% accuracy).

High-resolution Self-Organizing Maps for advanced visualization and dimension reduction

Kohonen’s Self Organizing feature Map (SOM) provides an effective way to project high dimensional input features onto a low dimensional display space while preserving the topological relationships among the input features. Recent advances in algorithms that take advantages of modern computing hardware introduced the concept of high resolution SOMs (HRSOMs). This paper investigates the capabilities and applicability of the HRSOM as a visualization tool for cluster analysis and its suitabilities to serve as a pre-processor in ensemble learning models. The evaluation is conducted on a number of established benchmarks and real-world learning problems, namely, the policeman benchmark, two web spam detection problems, a network intrusion detection problem, and a malware detection problem. It is found that the visualization resulted from an HRSOM provides new insights concerning these learning problems. It is furthermore shown empirically that broad benefits from the use of HRSOMs in both clustering and classification problems can be expected.

Density-based semi-supervised classification for intrusion detection

In order to improve the classification performance of intrusion detection problems with only a small number of labeled samples, semi-supervised learning is applied into the field of network intrusion. A semi-supervised classification method based on data density (SSC-density) is proposed to implement intrusion detection and solve network intrusion detection problem with fewer label samples. Firstly, the intrusion detection data is numerically numbered and normalized; secondly, the density of each sample is calculated, and the data samples are divided into security points, boundary points and noise points based on the density, so as to determine the spatial structure of the data; thirdly, different strategies are used for semi-supervised learning on different types of samples to mine the implicit information of unlabeled samples and expand the number of labeled samples. Specifically, deleting noise points, semi-supervised learning is firstly performed on the data set composed of security points, and then semi-supervised learning is performed on the data set composed of boundary points. Finally, the labeled samples are trained to generate the final classifier to realize the intrusion detection of network data. Experiments are carried out on KDD CUP 99 data set, the experimental result shows that the proposed algorithm has good classification performance.

A hybrid technique using binary particle swarm optimization and decision tree pruning for network intrusion detection

A major drawback of signature-based intrusion detection systems is the inability to detect novel attacks that do not match the known signatures already stored in the database. Anomaly detection is a kind of intrusion detection in which the activities of a system are monitored and these activities are classified as normal or anomalous based on their expected behavior. Tree-based classifiers have been successfully used to separate the abnormal behavior from the normal one. Tree pruning is a machine learning technique used to minimize the size of a decision tree (DT) in order to reduce the complexity of the classifier and improve its predictive accuracy. In this paper, we attempt to prune a DT using particle swarm optimization (PSO) algorithm and apply it to the network intrusion detection problem. The proposed technique is a hybrid approach in which PSO is used for node pruning and the pruned DT is used for classification of the network intrusions. Both single and multi-objective PSO algorithms are used in the proposed approach. The experiments are carried out on the well-known KDD99Cup dataset. This dataset has been widely used as a benchmark dataset for network intrusion detection problems. The results of the proposed technique are compared to the other state-of-the-art classifiers and it is observed that the proposed technique performs better than the other classifiers in terms of intrusion detection rate, false positive rate, accuracy, and precision.

Ramp loss K-Support Vector Classification-Regression; a robust and sparse multi-class approach to the intrusion detection problem

Network intrusion detection problem is an ongoing challenging research area because of a huge number of traffic volumes, extremely imbalanced data sets, multi-class of attacks, constantly changing the nature of new attacks and the attackers’ methods. Since the traditional network protection methods fail to adequately protect the computer networks, the need for some sophisticated methodologies has been felt. In this paper, we develop a precise, sparse and robust methodology for multi-class intrusion detection problem based on the Ramp Loss K-Support Vector Classification-Regression, named “Ramp-KSVCR”. The main objectives of this research are to address the following issues; 1) Highly imbalanced and skewed attacks’ distribution; hence, we utilized the K-SVCR model as a core of our model; 2) Sensitivity of SVM and its extensions to the presence of noises and outliers in the training sets, to cope with this problem, Ramp loss function is implemented to our model; 3) and since the proposed Ramp-KSVCR model is a non-differentiable non-convex optimization problem, we took Concave–Convex Procedure (CCCP) to solve this model. Furthermore, we introduced Alternating Direction Method of Multipliers (ADMM) procedure to make our model well-adapted to be applicable in the large-scale setting and to reduce the training time. The performance of the proposed method has been evaluated by some artificial data and also by conducting some experiments with the NSL-KDD data set and UNSW-NB15 as a recently published intrusion detection data set. Experimental results not only demonstrate the superiority of the proposed method over the traditional approaches tested against it in terms of generalization power and sparsity but also saving a considerable amount of computational time.

An effective intrusion detection framework based on MCLP/SVM optimized by time-varying chaos particle swarm optimization

Many organizations recognize the necessities of utilizing sophisticated tools and systems to protect their computer networks and reduce the risk of compromising their information. Although many machine-learning-based data classification algorithm has been proposed in network intrusion detection problem, each of them has its own strengths and weaknesses. In this paper, we propose an effective intrusion detection framework by using a new adaptive, robust, precise optimization method, namely, time-varying chaos particle swarm optimization (TVCPSO) to simultaneously do parameter setting and feature selection for multiple criteria linear programming (MCLP) and support vector machine (SVM). In the proposed methods, a weighted objective function is provided, which takes into account trade-off between the maximizing the detection rate and minimizing the false alarm rate, along with considering the number of features. Furthermore, to make the particle swarm optimization algorithm faster in searching the optimum and avoid the search being trapped in local optimum, chaotic concept is adopted in PSO and time varying inertia weight and time varying acceleration coefficient is introduced. The performance of proposed methods has been evaluated by conducting experiments with the NSL-KDD dataset, which is derived and modified from well-known KDD cup 99 data sets. The empirical results show that the proposed method performs better in terms of having a high detection rate and a low false alarm rate when compared with the obtained results using all features.

A hybrid PSO-SVM model for network intrusion detection

This paper concentrates on the problem of network intrusion detection, which is an important problem in informatisation construction. We utilise the incremental support vector machine SVM to solve the network intrusion detection problem, and the SVM classification problem can be tackled by a decision function via a quadratic program. Particularly, the incremental SVM is used to train an SVM classifier with a partition of the given dataset; at the same time, support vectors at every step are reserved and the training set for the next iteration is constructed. Furthermore, the crucial problem of the incremental SVM is to impose the Karush-Kuhn-Tucker KKT conditions on the training dataset when adding a new vector. Moreover, to optimise parameters in the incremental SVM, particle swarm optimisation is utilised. If there is at least one sample in the set incremental training sample dataset, which cannot satisfy the KKT condition, the SVM classifiers to detect network intrusion can be obtained. To make performance evaluation of the proposed algorithm, experiments are conducted using the 'KDD Cup 1999' dataset. Experimental results demonstrate that compared with other corresponding methods, the proposed algorithm can effectively detect network intrusion behaviours with high accuracy rate and low time consumption.

An artificial bioindicator system for network intrusion detection.

An artificial bioindicator system is developed in order to solve a network intrusion detection problem. The system, inspired by an ecological approach to biological immune systems, evolves a population of agents that learn to survive in their environment. An adaptation process allows the transformation of the agent population into a bioindicator that is capable of reacting to system anomalies. Two characteristics stand out in our proposal. On the one hand, it is able to discover new, previously unseen attacks, and on the other hand, contrary to most of the existing systems for network intrusion detection, it does not need any previous training. We experimentally compare our proposal with three state-of-the-art algorithms and show that it outperforms the competing approaches on widely used benchmark data.

Anomaly Detection in Wireless Sensor Networks Using Immune-Based Bioinspired Mechanism

During the past few years, we have seen a tremendous increase in various kinds of anomalies in Wireless Sensor Network (WSN) communication. Recently, researchers have shown a lot of interest in applying biologically inspired systems for solving network intrusion detection problems. Several solutions have been proposed using Artificial Immune System (AIS), Ant Colony Optimization (ACO), Artificial Bee Colony (ABC) algorithm, Genetic Algorithm (GA), Particle Swarm Optimization (PSO) and so forth. In this paper, we propose a bioinspired solution using Negative Selection Algorithm (NSA) of the AIS for anomalies detection in WSNs. For this purpose, we implement the enhanced NSA and make a detector set that holds anomalous packets only. Then the random packets are tested and matched with the detector set and anomalies are identified. Anomalous data packets are used for further processing to identify specific anomalies. In this way, the number of wormholes, packets delayed, and packets dropped are calculated and identified. Simulations are performed on a large dataset and the results show high accuracy of the proposed algorithm in detecting anomalies. The proposed NSA is also compared with Clonal Selection Algorithm (CSA) for the same dataset. The results show significant improvement of the proposed NSA over CSA in most of the cases.

Efficient Intrusion Detection Scheme based on SVM

The network intrusion detection problem is the focus of current academic research. In this paper, we propose to use Support Vector Machine (SVM) model to identify and detect the network intrusion problem, and simultaneously introduce a new optimization search method, referred to as Improved Harmony Search (IHS) algorithm, to determine the parameters of the SVM model for better classification accuracy. Taking the general mechanism network system of a growing city in China between 2006 and 2012 as the sample, this study divides the mechanism into normal network system and crisis network system according to the harm extent of network intrusion. We consider a crisis network system coupled with two to three normal network systems as paired samples. Experimental results show that SVMs based on IHS have a high prediction accuracy which can perform prediction and classification of network intrusion detection and assist in guarding against network intrusion.

On the robust synthesis of logical consensus algorithms for distributed intrusion detection

We introduce a novel consensus mechanism by which the agents of a network can reach an agreement on the value of a shared logical vector function depending on binary input events. Based on results on the convergence of finite-state iteration systems, we provide a technique to design logical consensus systems that minimizing the number of messages to be exchanged and the number of steps before consensus is reached, and tolerating a bounded number of failed or malicious agents. We provide sufficient joint conditions on the input visibility and the communication topology for the method’s applicability. We describe the application of our method to two distributed network intrusion detection problems.

Improvements on Self-Organizing Feature Maps for User-to-Root and Remote-to-Local Network Intrusion Detection on the 1999 KDD Cup Dataset

The problem of network intrusion detection is one that is ever-changing, ever-evolving, and is always in need of improvement. Since the method of attack is constantly changing, intrusion detection systems must also be constantly improved in order to compensate for the threat of new attacks. This paper is written to outline the improvements made upon the original paper published by Wilson et al. in which a self-organizing feature map-based intrusion detection system was trained using the 1999 KDD Cup competition training dataset and was used to successfully classify 63% of all user-to-root attacks within the 1999 KDD Cup competition testing dataset. This result shows an improvement of over five times the number of successfully detected userto-root attacks by the winner of the 1999 KDD Cup competition, submitted by Bernard Pfahringer.

Network intrusion detection in covariance feature space

Detecting multiple and various network intrusions is essential to maintain the reliability of network services. The problem of network intrusion detection can be regarded as a pattern recognition problem. Traditional detection approaches neglect the correlation information contained in groups of network traffic samples which leads to their failure to improve the detection effectiveness. This paper directly utilizes the covariance matrices of sequential samples to detect multiple network attacks. It constructs a covariance feature space where the correlation differences among sequential samples are evaluated. Two statistical supervised learning approaches are compared: a proposed threshold based detection approach and a traditional decision tree approach. Experimental results show that both achieve high performance in distinguishing multiple known attacks while the threshold based detection approach offers an advantage of identifying unknown attacks. It is also pointed out that utilizing statistical information in groups of samples, especially utilizing the covariance information, will benefit the detection effectiveness.

A Machine Learning Evaluation of an Artificial Immune System

ARTIS is an artificial immune system framework which contains several adaptive mechanisms. LISYS is a version of ARTIS specialized for the problem of network intrusion detection. The adaptive mechanisms of LISYS are characterized in terms of their machine-learning counterparts, and a series of experiments is described, each of which isolates a different mechanism of LISYS and studies its contribution to the system's overall performance. The experiments were conducted on a new data set, which is more recent and realistic than earlier data sets. The network intrusion detection problem is challenging because it requires one-class learning in an on-line setting with concept drift. The experiments confirm earlier experimental results with LISYS, and they study in detail how LISYS achieves success on the new data set.