Network Intrusion Detection Research Research Articles

An intelligent security mechanism in mobile Ad-Hoc networks using precision probability genetic algorithms (PPGA) and deep learning technique (Stacked LSTM)

The Mobile Ad-hoc Networks (MANETs) have gained a significant attention in the recent years due to their proliferation and huge application purposes. To defend from many types of modern cyber dangers like Distributed Denial of Service (DDoS) attacks, Advanced Persistent Threats (APTs), Insider Threats, Ransomware, Zero-Day Exploits, Social Engineering tactics, and etc is not easy when it comes to keeping MANETs security. These complex assaults focus on network infrastructure, take advantage of weaknesses in communication protocols and control user actions. Although there have been improvements in intrusion detection systems (IDS), it is still difficult to fully safeguard MANETs. The purpose of this research is to create advanced methods that can accurately find and decrease attacks inside MANETs. Applying Sensor-based Feature Extraction (SFE) to extract useful network features such as Received Signal Strength Indication (RSSI) and Time of Travel (TOT) from datasets NSL-KDD and CICIDS-2017. Utilizing the fresh method of Precise Probability Genetic Algorithm (PPGA) optimization for removing unrelated details, which enhances precision in detecting attacks. Predicting normal and attacking labels by applying Stacked Recurrent Long Short Term Memory (SRLSTM) method, fine-tuning classifier's parameters in every layer to improve outcomes. In order to authenticate and compare the suggested methods with current attack detection tactics, this study will make use of various evaluation measurements. The NSL-KDD, which is a benchmark dataset in network intrusion detection research, has a wide variety of network traffic data with instances that are labeled as normal and different attacks. CICIDS-2017 is similar because it contains an extensive dataset too - this includes real-world traces from network traffic where there's both regular activity and harmful actions. The purpose is to enhance the existing status of MANET security so as it can withstand more strongly against cyber dangers. According to the outcomes, it is analyzed that the attack detection accuracy has improved greatly 99 % when compared to other methods, as shown by the detailed assessment measurements. Better handling of big datasets with top detection accuracy reduces the time needed 8.9 s for training and testing models. Decrease in misclassification results and better ability to differentiate normal network actions from harmful intrusions. Improved resistance of MANETs to different cyber dangers, guaranteeing the safety and dependability of network communication in changing and non-centralized settings.

CUPID: A labeled dataset with Pentesting for evaluation of network intrusion detection

Reproducibility of network intrusion detection research necessitates widely available datasets that represent real-world scenarios. One of the key omissions of existing datasets used in empirical evaluations of network intrusions is the lack of human-generated traffic with accurate labels to distinguish benign and malicious behavior. Using an emulated network environment with a vulnerable web application, we collected baseline traffic, human-generated normal user traffic, automated attacks, and the attacks of ten human penetration testers of varying abilities. We preprocessed this collected data to produce a new dataset named the Colorado University Pentesting Intrusion Dataset (CUPID). The attacks span from reconnaissance activities to delivery of an exploit payload. To our knowledge, this is the first collection that provides labeled, Institutional Review Board-approved, benign and attacker data that is publicly available. The CUPID dataset can be used to train and test the limits of classification-based machine learning algorithms used for network intrusion detection systems.

Hunt for Unseen Intrusion: Multi-Head Self-Attention Neural Detector

A network intrusion detection (NID) system plays a critical role in cybersecurity. However, the existing machine learning-based NID research has a vital issue that their experimental settings do not reflect real-world situations where unknown attacks are constantly emerging. In particular, their train and test sets are from a single data set, which inevitably overestimates the detection power since all test attack types are known in training, and test cases will have similar characteristics to the training data. This paper introduces a new strategy to constitute test data with updated traffic with attack types not included in training data. In the proposed setting, the prediction accuracy of the existing detectors is dropped by about 20% compared to what has been reported. Also, in- depth analysis of detection performance by attack types has revealed that the existing models have strength at certain attack types but struggle to detect the other attack types such as DoS, DDoS, web attack, and port scan. To overcome the issues, we propose a new neural detector, called MHSA, based on a multi-head self-attention mechanism whose architecture suits better to capture scattered pieces of evidence in network traffic. Our model improved the overall detection performance by 29% in false positive rate at the true positive rate of 0.9 and by 9% in AUC over the current state-of-the-art models, successfully detecting the attacks that are not well captured before. Furthermore, we show that our proposed MHSA model even outperforms the best ensemble detector constructed by joining the state-of-the-art classifiers.

KDD Cup 99 Data Sets: A Perspective on the Role of Data Sets in Network Intrusion Detection Research

Many consider the KDD Cup 99 data sets to be outdated and inadequate. Therefore, the extensive use of these data sets in recent studies to evaluate network intrusion detection systems is a matter of concern. We contribute to the literature by addressing these concerns.

Collaborative quantum optimization network intrusion detection research

Collaborative quantum optimization network intrusion detection research

Developing an Intrusion Detection Framework for High-Speed Big Data Networks: A Comprehensive Approach

In network intrusion detection research, two characteristics are generally considered vital to building efficient intrusion detection systems (IDSs): an optimal feature selection technique and robust classification schemes. However, the emergence of sophisticated network attacks and the advent of big data concepts in intrusion detection domains require two more significant aspects to be addressed: employing an appropriate big data computing framework and utilizing a contemporary dataset to deal with ongoing advancements. As such, we present a comprehensive approach to building an efficient IDS with the aim of strengthening academic anomaly detection research in real-world operational environments. The proposed system has the following four characteristics: (i) it performs optimal feature selection using information gain and branch-and-bound algorithms; (ii) it employs machine learning techniques for classification, namely, Logistic Regression, Naive Bayes, and Random Forest; (iii) it introduces bulk synchronous parallel processing to handle the computational requirements of large-scale networks; and (iv) it utilizes a real-time contemporary dataset generated by the Information Security Centre of Excellence at the University of Brunswick (ISCX-UNB) to validate its efficacy. Experimental analysis shows the effectiveness of the proposed framework, which is able to achieve high accuracy, low computational cost, and reduced false alarms.

KCMC: A Hybrid Learning Approach for Network Intrusion Detection using K-means Clustering and Multiple Classifiers

A network Intrusion Detection System (IDS) is a security tool that acts as a defensive line. One of the most important challenges in network intrusion detection research area is designing an accurate intrusion detection system in terms of high detection rate, high accuracy and low false alarm rate. Hybrid learning approaches employ to deal with this challenge since, they have promising results in terms of detection rate, accuracy and false alarm rate. This paper, proposed a general structure of a hybrid learning approach. Then, the proposed approach has been implemented using Kmeans Clustering and Multiple Classifiers (KCMC). The data have been partitioned based on K-means clustering algorithm. Then, each partition classified using a distinct classifier. Naive Bayes, Support Vector Machines and OneR classification algorithms have been used as the classifiers. The proposed hybrid approach has better results comparing to single classifiers in terms of detection rate, accuracy and false alarm rate. The detection rate of the proposed hybrid learning approach is 99.50%.

Network Intrusion Detection based on GMKL Algorithm

According to the 31th statistical reports of China Internet network information center (CNNIC), by the end of December 2012, the number of Chinese netizens has reached 564 million, and the scale of mobile Internet users also reached 420 million. But when the network brings great convenience to people's life, it also brings huge threat in the life of people. So through collecting and analyzing the information in the computer system or network we can detect any possible behaviors that can damage the availability, integrity and confidentiality of the computer resource, and make timely treatment to these behaviors which have important research significance to improve the operation environment of network and network service. At present, the Neural Network, Support Vector machine (SVM) and Hidden Markov Model, Fuzzy inference and Genetic Algorithms are introduced into the research of network intrusion detection, trying to build a healthy and secure network operation environment. But most of these algorithms are based on the total sample and it also hypothesizes that the number of the sample is infinity. But in the field of network intrusion the collected data often cannot meet the above requirements. It often shows high latitudes, variability and small sample characteristics. For these data using traditional machine learning methods are hard to get ideal results. In view of this, this paper proposed a Generalized Multi-Kernel Learning method to applied to network intrusion detection. The Generalized Multi-Kernel Learning method can be well applied to large scale sample data, dimension complex, containing a large number of heterogeneous information and so on. The experimental results show that applying GMKL to network attack detection has high classification precision and low abnormal practical precision.

Negative Selection Algorithm Based on Double Matching Rules

The theory of artificial immune had been widely used in the research of network intrusion detection. Nowadays, the existing detector generating algorithms based on negative selection usually use a certain matching rule, as a result, too many detectors may generate, and the false alarm rate will become more serious. This paper proposes an improved negative selection algorithm using double matching rule: candidate detectors should be selected by the improved Hamming distance matching first, then the remaining detectors go through the segmented r-chunks(rch) matching rule. Experiments show that compared with traditional algorithms, this method brings a small number and more efficient detectors, reduces the false alarm rate and guarantees the efficiency of detectors.

A cascaded classifier approach for improving detection rates on rare attack categories in network intrusion detection

Network intrusion detection research work that employed KDDCup 99 dataset often encounter challenges in creating classifiers that could handle unequal distributed attack categories. The accuracy of...