Network Intrusion Detection System Research Articles

Anomaly-based Intrusion Detection System in Industrial IoT-Healthcare Environment Network

The Internet of Things (IoT) technology facilitates automation, monitoring, and control of tangible objects and surroundings by enabling connected devices to interact and exchange data over the Internet. Developments in edge computing, blockchain, and artificial intelligence (AI) are incorporated into IoT technologies for more reliable operations. Inadequate authorization, authentication, and encryption protocols could render IoT networks insecure and open the door to illegal access and data breaches which can have terrible consequences, most notably in the healthcare industry. In this regard, to identify malicious and incursion traffic, machine learning (ML) is crucial to Internet of Things (IoT) cybersecurity. The paper proposes a framework to detect intrusion or malicious traffic in IoT-enabled different medical equipment such as medical sensors, and controllers for real-time data collection, creating communication channels and data monitoring and analysis over locally available network nodes. IoT-Flock has been utilized for both normal and malicious traffic generation in a wide dataset found by the sensors connected to IoT integrated healthcare network. The feature selection-based proposed framework has been evaluated by three distinct machine learning classifiers, KNN, RF, and DT where corresponding accuracy, sensitivity, precision, and F1-score have been measured for performance analysis. With an accuracy of 99.74%, the KNN technique performed better than the other tactics used by RF and DT regarding intrusion detection in IoT networks. The suggested framework will be helpful in developing or analyzing security solutions in IoT-integrated network systems.

SYN-GAN: A robust intrusion detection system using GAN-based synthetic data for IoT security

As technological communication progresses, diverse datasets are exchanged across distributed environments using the Internet of Things (IoT). However, the IoT environment is vulnerable to attacking and breaching data privacy or making a robust system worse by providing attack data. To address potential risks of attacks, researchers have been conducting experiments on network intrusion detection systems (NIDS) to mitigate threats effectively. The issue of data imbalance and associated data collection costs persists, hindering the ability of machine learning (ML) models to learn malicious behaviour effectively and consequently impacting the accuracy of network threat detection. Addressing these issues, our study explores the potential of using 100% synthetic data generated via Generative Adversarial Networks (GAN) for training ML models in Network Intrusion Detection Systems (NIDS). This approach reduces the dependency on real-world data significantly, paving the way for a more flexible and ethically convenient model-building process. For the UNSW-NB15 dataset, we achieved an accuracy of 90%, a precision of 91%, a recall of 90%, and an F1 score of 89%. For the NSL-KDD dataset, our results showed an accuracy of 84%, a precision of 85%, a recall of 84%, and an F1 score of 84%. For the BoT-IoT dataset, we attained perfect scores of 100% across all metrics. These outcomes indicate that the values obtained from our analysis demonstrate high performance, yielding comparative or superior results to previous studies. Therefore, our study successfully replicates real-world network intrusion detection data, showing new opportunities for the use of generative data in cyber security.

Applying self-supervised learning to network intrusion detection for network flows with graph neural network

Graph Neural Networks (GNNs) have garnered intensive attention for Network Intrusion Detection System (NIDS) due to their suitability for representing the network traffic flows. However, most present GNN-based methods for NIDS are supervised or semi-supervised. Network flows need to be manually annotated as supervisory labels, a process that is time-consuming or even impossible, making NIDS difficult to adapt to potentially complex attacks, especially in large-scale real-world scenarios. The existing GNN-based self-supervised methods focus on the binary classification of network flow as benign or not, and thus fail to reveal the types of attack in practice. This paper studies the application of GNNs to identify the specific types of network flows in an unsupervised manner. We first design an encoder to obtain graph embedding, that introduces the graph attention mechanism and considers the edge information as the only essential factor. Then, a self-supervised method based on graph contrastive learning is proposed. The method samples center nodes, and for each center node, generates subgraph by it and its direct neighbor nodes, and corresponding contrastive subgraph from the interpolated graph, and finally constructs positive and negative samples from subgraphs. Furthermore, a structured contrastive loss function based on edge features and graph local topology is introduced. To the best of our knowledge, it is the first GNN-based self-supervised method for the multiclass classification of network flows in NIDS. Detailed experiments conducted on four real-world datasets (NF-Bot-IoT, NF-Bot-IoT-v2, NF-CSE-CIC-IDS2018, and NF-CSE-CIC-IDS2018-v2) systematically compare our model with the state-of-the-art supervised and self-supervised models, illustrating the considerable potential of our method. Our code is accessible through https://github.com/renj-xu/NEGSC.

VAIDANSHH: Adaptive DDoS detection for heterogeneous hosts in vehicular environments

Vehicular networks are vulnerable to Distributed Denial of Service (DDoS), an extension of a Denial of Service (DoS) attack. The existing solutions for DDoS detection in vehicular networks use various Machine Learning (ML) algorithms. However, these algorithms are applicable only in a single layer in a vehicular network environment and are incapable of detecting DDoS dynamics for different layers of the network infrastructure. The recently reported attacks on transport networks reveal the fact that a research gap exists between the existing solutions and the multi-layer DDoS detection strategy requirements. Additionally, the majority of the current detection methods fail in the consideration of traffic heterogeneity and are not rate-adaptive, where both the mentioned parameters are important for an effective detection system.In this paper, we introduce a comprehensive ML-based Network Intrusion Detection System (NIDS) against DDoS attacks in vehicular networks. Our proposed NIDS combines a three-tier security model, traffic adaptivity, and heterogeneity traffic provisions. We call our model Vehicular Adaptive Intrusion Detection And Novel System for Heterogeneous Hosts (VAIDANSHH). As mentioned earlier, VAIDANSHH has a three-tier security system: at RSU's hardware, communication channel, and RSU application level. VAIDANSHH combines the Adaptive Alarming Module (AAM) and the Detection Module (DM) for data generation, collection of generated data, flow monitoring, pre-processing, and classification. We use the NS3 simulation tool for our experiments to generate synthetic data and apply ML with WEKA. We run a thorough set of experiments, which show that VAIDANSHH detects UDP flooding, a form of DDoS attack, with 99.9% accuracy within a very short time. We compare VAIDANSHH with other state-of-the-art models; the comparative analysis shows that VAIDANSHH is superior in terms of accuracy and its multi-tier workflow.

GDLC: A new Graph Deep Learning framework based on centrality measures for intrusion detection in IoT networks

The increasing growth of the Internet of Things (IoT) with the diverse and dynamic nature of devices made detecting and preventing network intrusions more important and challenging. As new and sophisticated cyber-attacks are being used, there is an increasing need for advanced intrusion detection systems that can adapt to emerging threats. The majority of existing methods in the literature lack a comprehensive consideration of complex network features namely the centrality measures. Previous works overlooked the potential insights that can be obtained from the structured relationships within network traffic data. In this study, we propose an approach called Graph Deep Learning framework based on Centrality measures (GDLC). Our approach includes an algorithm to dynamically select the most appropriate centrality measures according to the network’s topological properties created from traffic data. After that, they are integrated with Artificial Intelligence (AI) techniques, specifically the deep learning models: CNN, LSTM, and GRU. We tested our methodology on multiple publicly available cybersecurity datasets, having different network structures and sizes. First, we employ the Susceptible Infectious Recovered (SIR) model to validate the importance of the added centrality measures in identifying the most influential nodes that can be the subject of intrusion attacks. Then, through extensive experimentation and evaluation, we test the effectiveness of our approach in improving the accuracy of the Network Intrusion Detection System (NIDS). The obtained results indicate a significant enhancement in detection rates, that can reach up to 7.7%. This improvement demonstrates the practical value of our proposed methodology and highlights its high capacity to adapt to varying network structures. Integrating AI and complex network features is a promising approach for enhancing the capabilities of the Network Intrusion Detection System, contributing to a more resilient cybersecurity framework.

Network Intrusion Detection System

Network intrusion detection systems (NIDS) play a crucial role in safeguarding network infrastructures against unauthorized access and malicious activities. This abstract explores the fundamental concepts, methodologies, and challenges associated with NIDS. It delves into the various techniques employed by NIDS, ranging from signature-based detection to anomaly detection, and highlights the importance of real-time monitoring and analysis for timely threat detection and response. Additionally, the abstract discusses the evolving landscape of cyber threats and the need for continuous adaptation and enhancement of NIDS to mitigate emerging risks effectively. Furthermore, it addresses the trade-offs between detection accuracy, resource utilization, and scalability, emphasizing the significance of striking a balance to ensure optimal NIDS performance in diverse network environments. Overall, this abstract provides a comprehensive overview of NIDS, underscoring its indispensable role in fortifying network security posture in the face of evolving cyber threats. Keywords- Network, intrusion, detection, NIDS, threat.

An Improved Network Intrusion Detection Method Based On CNN-LSTM-SA

Network intrusion detection is an essential component of contemporary cybersecurity strategies, and the development of efficient techniques to accurately identify malicious activities has become a priority. This study investigates the performance of various conventional machine learning algorithms, including decision trees, naive Bayes, naive Bayes trees, random forest, random trees, MLP, and SVM, in detecting network intrusions using binary and multi-classification approaches. Furthermore, the study proposes a deep learning method, CNN-LSTM-SA, which consistently outperforms conventional machine learning techniques in terms of precision, recall, F1 score, and overall accuracy for network intrusion detection. Specifically, the proposed method combines CNN and LSTM with SA in machine learning theory to extract more optimized, strongly correlated features. The proposed method is evaluated using the benchmark NSL-KDD database. The results indicate that the CNN-LSTM-SA method holds great potential in enhancing the efficacy of network intrusion detection systems.

An effective ensemble classification framework for intrusion detection system using LSTM autoencoder

In intrusion detection, the curse of dimensionality and the trade-off between maintaining a low false alarm rate and achieving a high detection rate are significant challenges. This research suggests a unique strategy based on dimensionality reduction methods to improve the performance of network intrusion detection systems (NIDS). Compressing high-dimensional network traffic data using a Long Short-Term Memory Autoencoder (LSTMAE) allows the reduced characteristics to be submitted to a classifier to identify anomalies that may indicate an attack. Using standard datasets, including Network Security Laboratory - Knowledge Discovery in Datasets (NSL-KDD), UNSW-NB15, and Canadian Institute for Cyber Security - Intrusion Detection Systems (CICIDS2017), the proposed model is tested with classifiers like Random Forest (RF) and LightGBM (Light Gradient Boosting Machines). It is hoped that by adopting this method, NIDS response times may be improved while costs associated with storing and processing data are minimized. Precision, recall, F-score, accuracy, detection rate (DR), and false alarm rate (FAR) are only a few of the performance measures used to assess the quality of the suggested models. The experimental findings show that the proposed LSTMAE model reduces prediction errors more effectively than classic machine learning techniques such as Random Forest (RF), Gradient Boosting (GB), Support Vector Machines (SVM), Deep Belief Networks (DBN), Deep Neural Networks (DNN), Autoencoder (AE), and Long Short-Term Memory (LSTM). The results also show that the proposed solution outperforms the state-of-the-art methods of detection accuracy and computing complexity using accuracy, precision, recall, F1_Score, detection rate, and FAR.

Impacting Robustness in Deep Learning-Based NIDS through Poisoning Attacks

The rapid expansion and pervasive reach of the internet in recent years have raised concerns about evolving and adaptable online threats, particularly with the extensive integration of Machine Learning (ML) systems into our daily routines. These systems are increasingly becoming targets of malicious attacks that seek to distort their functionality through the concept of poisoning. Such attacks aim to warp the intended operations of these services, deviating them from their true purpose. Poisoning renders systems susceptible to unauthorized access, enabling illicit users to masquerade as legitimate ones, compromising the integrity of smart technology-based systems like Network Intrusion Detection Systems (NIDSs). Therefore, it is necessary to continue working on studying the resilience of deep learning network systems while there are poisoning attacks, specifically interfering with the integrity of data conveyed over networks. This paper explores the resilience of deep learning (DL)—based NIDSs against untethered white-box attacks. More specifically, it introduces a designed poisoning attack technique geared especially for deep learning by adding various amounts of altered instances into training datasets at diverse rates and then investigating the attack’s influence on model performance. We observe that increasing injection rates (from 1% to 50%) and random amplified distribution have slightly affected the overall performance of the system, which is represented by accuracy (0.93) at the end of the experiments. However, the rest of the results related to the other measures, such as PPV (0.082), FPR (0.29), and MSE (0.67), indicate that the data manipulation poisoning attacks impact the deep learning model. These findings shed light on the vulnerability of DL-based NIDS under poisoning attacks, emphasizing the significance of securing such systems against these sophisticated threats, for which defense techniques should be considered. Our analysis, supported by experimental results, shows that the generated poisoned data have significantly impacted the model performance and are hard to be detected.

Integrated Spatial and Temporal Features Based Network Intrusion Detection System Using SMOTE Sampling

With attackers discovering more inventive ways to take advantage of network weaknesses, the pace of attacks has drastically increased in recent years. As a result, network security has never been more important, and many network intrusion detection systems (NIDS) rely on old, out-of-date attack signatures. This necessitates the deployment of reliable and modern Network Intrusion Detection Systems that are educated on the most recent data and employ deep learning techniques to detect malicious activities. However, it has been found that the most recent datasets readily available contain a large quantity of benign data, enabling conventional deep learning systems to train on the imbalance data. A high false detection rate result from this. To overcome the aforementioned issues, we suggest a Synthetic Minority Over-Sampling Technique (SMOTE) integrated convolution neural network and bi-directional long short-term memory SCNN-BIDLSTM solution for creating intrusion detection systems. By employing the SMOTE, which integrates a convolution neural network to extract spatial features and a bi-directional long short-term memory to extract temporal information; difficulties are reduced by increasing the minority samples in our dataset. In order to train and evaluate our model, we used open benchmark datasets as CIC-IDS2017, NSL-KDD, and UNSW-NB15 and compared the results with other state of the art models.

Predicting anomalies in computer networks using autoencoder-based representation learning

<span>Recent improvements in the internet of things (IoT), cloud services, and network data variety have increased the demand for complex anomaly detection algorithms in network intrusion detection systems (IDSs) capable of dealing with sophisticated network threats. Academics are interested in deep and machine learning (ML) breakthroughs because they have the potential to address complex challenges such as zero-day attacks. In comparison to firewalls, IDS are the initial line of network security. This study suggests merging supervised and unsupervised learning in identification systems IDS. Support vector machine (SVM) is an anomaly-based classification classifier. Deep autoencoder (DAE) lowers dimensionality. DAE are compared to principal component analysis (PCA) in this study, and hyper-parameters for F-1 micro score and balanced accuracy are specified. We have an uneven set of data classes. precision-recall curves, average precision (AP) score, train-test times, t-SNE, grid search, and L1/L2 regularization methods are used. KDDTrain+ and KDDTest+ datasets will be used in our model. For classification and performance, the DAE+SVM neural network technique is successful. Autoencoders outperformed linear PCA in terms of capturing valuable input attributes using t-SNE to embed high dimensional inputs on a two-dimensional plane. Our neural system outperforms solo SVM and PCA encoded SVM in multi-class scenarios.</span>

FEDDBN-IDS: federated deep belief network-based wireless network intrusion detection system

Over the last 20 years, Wi-Fi technology has advanced to the point where most modern devices are small and rely on Wi-Fi to access the internet. Wi-Fi network security is severely questioned since there is no physical barrier separating a wireless network from a wired network, and the security procedures in place are defenseless against a wide range of threats. This study set out to assess federated learning, a new technique, as a possible remedy for privacy issues and the high expense of data collecting in network attack detection. To detect and identify cyber threats, especially in Wi-Fi networks, the research presents FEDDBN-IDS, a revolutionary intrusion detection system (IDS) that makes use of deep belief networks (DBNs) inside a federated deep learning (FDL) framework. Every device has a pre-trained DBN with stacking restricted Boltzmann machines (RBM) to learn low-dimensional characteristics from unlabelled local and private data. Later, these models are combined by a central server using federated learning (FL) to create a global model. The whole model is then enhanced by the central server with fully linked SoftMax layers to form a supervised neural network, which is then trained using publicly accessible labeled AWID datasets. Our federated technique produces a high degree of classification accuracy, ranging from 88% to 98%, according to the results of our studies.

A Hybrid Particle Swarm Optimization and C4.5 for Network Intrusion Detection and Prevention System

Network Intrusion Detection and Prevention systems (NIDPS) ensure network security and used to effectively detect various attacks and completely stop them from intruding over a network. Since, securing sensitive information carried by various organizations is much more significant, developing enhanced security models become inevitable. To meet the growing demand in safeguarding the network from various known and unknown attacks. In this paper, a Hybrid Particle Swarm Optimization and C4.5 (HPSOCM) method is proposed to network based intrusion prevention system to detect unknown attacks and a signature based SNORT method to detect the known attacks in NIDS. In the hybrid method, we use data mining approach to mine the unknown attacks. Hence, we develop an anomalous detection model and train it using the data mining rules. The trained network is capable of detecting various unknown attacks. The conventional signature based SNORT method detects the known attacks by matching the detected threats from the KDD99 dataset. The proposed HPSOCM method is demonstrated using simulation and the performances were evaluated in terms of Accuracy, Specificity, Detection Rate and False Alarm Rate. The proposed method had produced better efficiency compared to various other existing methods.

Multi-Pattern GPU Accelerated Collision-Less Rabin-Karp for NIDS

In the domain of network communication, network intrusion detection systems (NIDS) play a crucial role in maintaining security by identifying potential threats. NIDS relies on packet inspection, often using rule-based databases to scan for malicious patterns. However, the expanding scale of internet connections hampers the rate of packet inspection. To address this, some systems employ GPU accelerated pattern matching algorithms. Yet, this approach is susceptible to denial of service (DOS) attacks, inducing hashing collisions and slowing inspection. This research introduces a GPU-optimized variation of the Rabin-Karp algorithm, achieving scalability on GPUs while resisting DOS attacks. Our open-source solution (https://github.com/AnasAbbas1/NIDS) combines six polynomial hashing functions, eliminating the need for false-positive validation. This leads to a substantial improvement in inspection speed and accuracy. The proposed system ensures minimal packet misclassification rates, solidifying its role as a robust tool for real-time network security.

Generating practical adversarial examples against learning-based network intrusion detection systems

Generating practical adversarial examples against learning-based network intrusion detection systems

End-to-End Network Intrusion Detection Based on Contrastive Learning.

The network intrusion detection system (NIDS) plays a crucial role as a security measure in addressing the increasing number of network threats. The majority of current research relies on feature-ready datasets that heavily depend on feature engineering. Conversely, the increasing complexity of network traffic and the ongoing evolution of attack techniques lead to a diminishing distinction between benign and malicious network behaviors. In this paper, we propose a novel end-to-end intrusion detection framework based on a contrastive learning approach. We design a hierarchical Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) model to facilitate the automated extraction of spatiotemporal features from raw traffic data. The integration of contrastive learning amplifies the distinction between benign and malicious network traffic in the representation space. The proposed method exhibits enhanced detection capabilities for unknown attacks in comparison to the approaches trained using the cross-entropy loss function. Experiments are carried out on the public datasets CIC-IDS2017 and CSE-CIC-IDS2018, demonstrating that our method can attain a detection accuracy of 99.9% for known attacks, thus achieving state-of-the-art performance. For unknown attacks, a weighted recall rate of 95% can be achieved.

Data fusion and network intrusion detection systems

Data fusion and network intrusion detection systems

Advanced Network Intrusion Detection with TabTransformer

In today's digital era, the security of networked systems is of utmost importance amidst the increasing prevalence of cyber threats and sophisticated intrusion techniques. This paper addresses the critical need for robust network intrusion detection systems (NIDS) in today's digital landscape, amidst escalating cyber threats. Leveraging a dataset derived from a simulated military network environment, we explore various intrusion scenarios encountered in cyber warfare. Reviewing existing literature reveals a spectrum of methodologies, including anomaly-based and deep learning approaches. To enhance current methodologies, we propose a binary classification framework using TabTransformer, a transformer-based architecture, for network intrusion detection. We present detailed methodology, encompassing data preprocessing, model architecture, and evaluation metrics, with empirical results demonstrating the efficacy of our approach in mitigating cyber threats and enhancing network security.

Coarse and fine feature selection for Network Intrusion Detection Systems (IDS) in IoT networks

AbstractNetwork Intrusion Detection Systems (NIDSs) are important in safeguarding networks from known and unknown attacks. Many research efforts have recently been made to create NIDS systems based on Machine Learning (ML) methods, addressing a significant challenge in designing standard NIDS the lack of standardized feature sets in the dataset. Given the recent development of the Internet of Things (IoT) in wireless communication, our proposed method introduces a novel solution to enhance intrusion detection systems. This proposed solution feature selection is carried out in two stages, coarse and fine selection. In the first stage of the coarse selection process, we conduct correlation analysis to identify relationships within the feature set. The second stage employs fine selection using the Whale Optimization Algorithm (WOA) with Genetic Algorithm hybridization (CFWOAGA). The fitness of each selected feature is assessed using the K‐Nearest Neighbors (KNN) algorithm. In our proposed work we integrate WOA with hybrid GA to extend the search space and avoid local optima problems via crossover and mutation operations. These selected features are critical for detecting any intrusion, we use an ML classifier to identify whether there is an attack or normal in the network and we evaluate the performance of each classifier. We evaluate the performance of our classifier using the BoT‐IoT 2020 standard dataset while limiting the selected features to 32 for reduced computational complexity, these selected 32 features are based upon considerations of system optimization and efficiency, making a balance between computational efficiency and model performance. The experimental findings show better model accuracy compared to the WOA technique and a significant drop in the False Alarm Rate (FAR). In conclusion, our proposed CFWOA method achieved an accuracy of 98.9%, while an updated version with the genetic algorithm demonstrated further improvement at 99.5%. Notably, there was a substantial improvement in FAR with our proposed method.

Evaluating the impact of different Feature as a Counter data aggregation approaches on the performance of NIDSs and their selected features

Abstract There is much effort nowadays to protect communication networks against different cybersecurity attacks (which are more and more sophisticated) that look for systems’ vulnerabilities they could exploit for malicious purposes. Network Intrusion Detection Systems (NIDSs) are popular tools to detect and classify such attacks, most of them based on ML models. However, ML-based NIDSs cannot be trained by feeding them with network traffic data as it is. Thus, a Feature Engineering (FE) process plays a crucial role transforming network traffic raw data onto derived one suitable for ML models. In this work, we study the effects of applying one such FE technique in different ways on the performance of two ML models (linear and non-linear) and their selected features. This the Feature as a Counter approach. The derived observations are computed from either with the same number of raw samples, (batch-based approaches) or by aggregating them by time intervals (timestamp-based approach). Results show that there is no significant differences between the proposed approaches neither in the performance of the models nor in the selected features that validate our proposal making it feasible to be widely used as a standard FE method.