Neural Network Intrusion Detection Research Articles

CNN-based Network Intrusion Detection and Classification Model for Cyber-Attacks

A Convolution Neural Network (CNN)-based Network Intrusion Detection Model for Cyber-attacks is of great value in identifying and classifying attacks on any network. The Knowledge Discovery in Database Cup '99 dataset containing approximately 4,900,000 single connection vectors was divided into two phases; 75% of the total dataset was used during the learning process of the machine learning technique, while 25% was used on a fully trained model to validate and evaluate its performance. The model's performance indicated that it can detect and classify different classes of attacks with an accuracy of 98% with 20 epochs at a 0.001 learning rate using machine learning. The model loss for the training and validation was 7.48% and 7.98%, respectively, over 20 epochs, which implies that the model performed better on the training dataset. This study demonstrated that the convolutional Neural network-based Network Intrusion Detection and classification model shows high detection and low false negative rates. The CNN model offers a high detection rate and fidelity to unknown attacks, i.e., it can differentiate between already-seen attacks and new zero-day attacks. At the end of the experiment, the proposed approach is suitable in modeling the network IDS for detecting intrusion attacks on computer networks thereby enabling a secured environment for the proper functioning of the system

An effective classification using enhanced elephant herding optimization with convolution neural network for intrusion detection in IoMT architecture

An effective classification using enhanced elephant herding optimization with convolution neural network for intrusion detection in IoMT architecture

SACNN‐IDS: A self‐attention convolutional neural network for intrusion detection in industrial internet of things

SACNN‐IDS: A self‐attention convolutional neural network for intrusion detection in industrial internet of things

Exploring the effect of training-time randomness on the performance of deep neural networks for intrusion detection

Exploring the effect of training-time randomness on the performance of deep neural networks for intrusion detection

An Intrusion Detection Model Based on Feature Selection and Improved One-Dimensional Convolutional Neural Network

The problem of intrusion detection has new solutions, thanks to the widespread use of machine learning in the field of network security, but it still has a few issues at this time. Traditional machine learning techniques to intrusion detection rely on expert experience to choose features, and deep learning approaches have a low detection efficiency. In this paper, an intrusion detection model based on feature selection and improved one-dimensional convolutional neural network was proposed. This model first used the extreme gradient boosting decision tree (XGboost) algorithm to sort the preprocessed data, and then it used comparison to weed out 55 features with a higher contribution. Then, the extracted features were fed into the improved one-dimensional convolutional neural network (I1DCNN), and this network training was used to complete the final classification task. The feature selection and improved one-dimensional convolutional neural network (FS-I1DCNN) intrusion detection model not only solved the traditional machine learning method of relying on expert experience to extract features but also improved the detection efficiency of the model, reduced the training time while reducing the dimension, and increased the overall accuracy. In comparison to the I1DCNN model without feature extraction and the conventional one-dimensional convolutional neural network (1DCNN) model, the experimental results demonstrate that the FS-I1DCNN model’s overall accuracy increases by 0.67% and 2.94%, respectively. Its accuracy, precision, recall, and F1-score were significantly better than those of the other intrusion detection models, including SVM and DBN.

SOINN Intrusion Detection Model Based on Three-Way Attribute Reduction

With a large number of intrusion detection datasets and high feature dimensionality, the emergent nature of new attack types makes it impossible to collect network traffic data all at once. The modified three-way attribute reduction method is combined with a Self-Organizing Incremental learning Neural Network (SOINN) algorithm to propose a self-organizing incremental neural network intrusion detection model based on three-way attribute reduction. Attribute importance is used to perform attribute reduction, and the data after attribute reduction are fed into a self-organized incremental learning neural network algorithm, which generalizes the topology of the original data through self-organized competitive learning. When the streaming data are transferred into the model, the inter-class insertion or node fusion operation is performed by comparing the inter-node distance and similarity threshold to achieve incremental learning of the model streaming data. The inter-node distance value is introduced into the weight update formulation to replace the traditional learning rate and to optimize the topological structure adjustment operation. The experimental results show that T-SOINN achieves high precision and recall when processing intrusion detection data.

Convolutional neural network for intrusion detection using blockchain technology

Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.

Network Intrusion Detection Using Autoencode Neural Network

In today's interconnected digital landscape, safeguarding computer networks against unauthorized access and cyber threats is of paramount importance. NIDS play a crucial role in identifying and mitigating potential security breaches. This research paper explores the application of autoencoder neural networks, a subset of deep learning techniques, in the realm of Network Intrusion Detection.Autoencoder neural networks are known for their ability to learn and represent data in a compressed, low-dimensional form. This study investigates their potential in modeling network traffic patterns and identifying anomalous activities. By training autoencoder networks on both normal and malicious network traffic data, we aim to create effective intrusion detection models that can distinguish between benign and malicious network behavior.The paper provides an in-depth analysis of the architecture and training methodologies of autoencoder neural networks for intrusion detection. It also explores various data preprocessing techniques and feature engineering approaches to enhance the model's performance. Additionally, the research evaluates the robustness and scalability of autoencoder-based NIDS in real-world network environments. Furthermore, ethical considerations in network intrusion detection, including privacy concerns and false positive rates, are discussed. It addresses the need for a balanced approach that ensures network security while respecting user privacy and minimizing disruptions. operation. This approach compresses the majority samples & increases the minority sample count in tough samples so that the IDS can achieve greater classification accuracy.

Intrusion detection for Industrial Internet of Things based on deep learning

Intrusion detection technology can actively detect abnormal behaviors in the network and is important to the security of Industrial Internet of Things (IIOT). However, there are some issues with the current intrusion detection technology for IIOT, such as extreme imbalance in the number of samples of different classes in the dataset, redundant and meaningless features in the samples, and the inability of traditional intrusion detection methods to meet the requirements of detection accuracy in the increasingly complex IIOT. In view of the extreme imbalance of classes, this paper applies the hierarchical clustering algorithm to the under-sampling technology, which reduces the number of majority samples while reducing the loss of information of majority samples, and solves the problem of missing detection and false detection of minority samples caused by sample imbalance. In order to avoid feature redundancy and interference, this paper proposes an optimal feature selection algorithm based on greedy thought. This algorithm can obtain the optimal feature subset of each type of data in the data set, thus eliminating redundant and interfering features. Aiming at the problem of insufficient detection ability of traditional detection methods, this paper proposes a deep neural network intrusion detection model based on the parallel connection of global and local subnetworks. This model obtains the overall benchmark detection of the dataset through the deep neural network, and then strengthens the detection effect of each subclass through the parallel connection of subnetworks, greatly improving the performance of the intrusion detection algorithm. The experimental results show that the method described in this paper can improve the intrusion detection for IIOT.

An efficient and secure key management with the extended convolutional neural network for intrusion detection in cloud storage

SummaryCloud computing aids users for storing and recovering their information everywhere in the world. Security and efficiency are the two main issues in cloud service. Numerous intrusion detection techniques for the cloud computing environment were proposed, but those techniques do not effectively and accurately detect the attacks. Hence, an efficient and secure key management using extended convolutional neural network, that is, hybrid Enhanced Elman Spike convolutional Neural Network optimized with improved COOT optimization algorithm (Hyb EESCCNN) is proposed for intrusion detection in cloud system. Furthermore, the novel Adaptive Tangent Brakerski‐Gentry Vaikuntanathan Homomorphic Encryption (ATBGVHE) method is proposed for providing the security of the system. At first, SHA‐512 is used for authenticating cloud users to store its own information in to the cloud server. Then for Intrusion Detection (ID) the input data from the NSL‐KDD, UNSWNB15, CICIDS2018, and ToN‐IoT datasets are pre‐processed. The most relevant features are extracted using Fast Independent Component Analysis (Fast ICA) from the pre‐processed output. These extracted data are classified into malicious and non‐malicious data using Hyb EESCCNN. After classification, the non‐malicious data is secured using an ATBGVHE technique. The outcomes of the proposed methods shows that the NSL‐KDD datasets attains 99.9% higher accuracy, UNSW‐NB15 datasets offer 99.89% higher accuracy, CSE‐CIC‐IDS2018 datasets attains 99.8% higher accuracy, ToN‐IoT datasets attains 99.8% higher accuracy and 0.02 s lower encryption time compared with existing methods. Finally, case study with real time applications is also analyzed to prove the efficiency of the proposed method.

INCORPORATING A HONEYFARM WITH MLFFNN IDS FOR IMPROVING INTRUSION DETECTION

Today’s networks must deal with dynamically changing threats each day. Use of static datasets to train and prepare multi-layer feed forward neural network intrusion detection systems (MLFFNN IDS) doesn’t address these new threats. The use of real traffic data to train neural network IDSs has been out of reach in organizations due to privacy and concerns. Now the use of a honeyfarm system can provide real-time data to a MLFFNN IDS so that it can adjust to new threats as they begin. This system also removes the privacy and concerns since information about the network is false and acts as a decoy to lure attackers away from the real organizational network. This paper introduces a honeyfarm architecture one can use with a MLFFNN IDS to improve intrusion detection capability.

An authentication approach in SDN-VANET architecture with Rider-Sea Lion optimized neural network for intrusion detection

Vehicular Ad-hoc Network (VANET) offers expedient services in intellectual transportation models but is susceptible to several attacks. The Intrusion detection systems (IDSs) help to prevent security risks by discovering irregular network behaviours under local sub-networks inspite of complete VANET. An optimization-driven model is devised for detecting intrusion in SDN-VANET. The network comprises several entities, like the On-Board Unit (OBU), SDN, Road-Side Unit (RSU), and Authentication Server. The proposed approach involves five phases, namely registration, key generation, data encoding, authentication, and decoding. The authentication of OBU is done with the data packets. The detection of intrusion is performed using the optimized model. The selection of features is done from log files considering the Renyi entropy. The detection of intrusion is done using the Rider-based neural network (RideNN), trained with designed Rider-based Sea Lion Optimization (RBSLO), and is produced by blending the Rider optimization algorithm (ROA) and Sea Lion Optimization (SLnO). The proposed RBSLO-based RideNN offered to improve the achievement with the elevated precision of 92.5%, the recall of 95.4%, the F-measures of 94%, and the smallest computation time of 135.654 s.

Graph Neural Networks for Intrusion Detection: A Survey

Graph Neural Networks for Intrusion Detection: A Survey

Optimal Wavelet Neural Network-Based Intrusion Detection in Internet of Things Environment

As the Internet of Things (IoT) endures to develop, a huge count of data has been created. An IoT platform is rather sensitive to security challenges as individual data can be leaked, or sensor data could be used to cause accidents. As typical intrusion detection system (IDS) studies can be frequently designed for working well on databases, it can be unknown if they intend to work well in altering network environments. Machine learning (ML) techniques are depicted to have a higher capacity at assisting mitigate an attack on IoT device and another edge system with reasonable accuracy. This article introduces a new Bird Swarm Algorithm with Wavelet Neural Network for Intrusion Detection (BSAWNN-ID) in the IoT platform. The main intention of the BSAWNN-ID algorithm lies in detecting and classifying intrusions in the IoT platform. The BSAWNN-ID technique primarily designs a feature subset selection using the coyote optimization algorithm (FSS-COA) to attain this. Next, to detect intrusions, the WNN model is utilized. At last, the WNN parameters are optimally modified by the use of BSA. A widespread experiment is performed to depict the better performance of the BSAWNN-ID technique. The resultant values indicated the better performance of the BSAWNN-ID technique over other models, with an accuracy of 99.64% on the UNSW-NB15 dataset.

Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning

Deep learning (DL) greatly enhances binary anomaly detection capabilities through effective statistical network characterization; nevertheless, the intrusion class differentiation performance is still insufficient. Two related challenges have not been fully explored. 1) Statistical attack characteristics are overemphasized while ignoring inherent attack topologies; sequence features are extracted from whole traffic flows, but the interaction evolution of each IP pair over time is rarely considered, such as in long short-term memory (LSTM) and gated recurrent units (GRUs). 2) Meeting the need for many high-quality labeled data samples is an expensive and labor-intensive task in large-scale, complex, and heterogeneous networks. To address these issues, we propose a dynamic line graph neural network (DLGNN)-based intrusion detection method with semisupervised learning. Our model converts network traffic into a series of spatiotemporal graphs. A dynamic GNN (DGNN) is employed to extract spatial information from each discrete snapshot and capture the contextual evolution of communication between IP pairs through consecutive snapshots. Moreover, a line graph realizes edge embedding expressions corresponding to network communications and strengthens the message aggregation ability of graph convolution. Experiments on 6 novel datasets demonstrate that our approach achieves 98.15–99.8% accuracy in abnormality detection with fewer labeled samples. Meanwhile, state-of-the-art multiclass performance is achieved, e.g., the average detection accuracy for DDoS across the 6 datasets reaches 95.32%.

Internet of Things Intrusion Detection System Based on Convolutional Neural Network

In recent years, the Internet of Things (IoT) technology has developed by leaps and bounds. However, the large and heterogeneous network structure of IoT brings high management costs. In particular, the low cost of IoT devices exposes them to more serious security concerns. First, a convolutional neural network intrusion detection system for IoT devices is proposed. After cleaning and preprocessing the NSL-KDD dataset, this paper uses feature engineering methods to select appropriate features. Then, based on the combination of DCNN and machine learning, this paper designs a cloud-based loss function, which adopts a regularization method to prevent overfitting. The model consists of one input layer, two convolutional layers, two pooling layers and three fully connected layers and one output layer. Finally, a framework that can fully consider the user’s privacy protection is proposed. The framework can only exchange model parameters or intermediate results without exchanging local individuals or sample data. This paper further builds a global model based on virtual fusion data, so as to achieve a balance between data privacy protection and data sharing computing. The performance indicators such as accuracy, precision, recall, F1 score, and AUC of the model are verified by simulation. The results show that the model is helpful in solving the problem that the IoT intrusion detection system cannot achieve high precision and low cost at the same time.

Jaya-Mutated Leader Algorithm Based Deep Feed Forward Neural Network for Intrusion Detection Using Cloud Computing

Cloud computing is a compulsory choice preferred by every Information Technology (IT) organization as it is more flexible to use with wide service. However, privacy and security are major disturbances to its success because of distributed and open architecture, which is susceptible to intruders. In cloud computing, intrusion detection system (IDS) is most prominently utilized mechanism for detecting attacks. This article provides algorithm-based deep feed forward neural network (DFFNN) to detect intrusions in cloud. Here, training for DFFNN is provided by proposed Jaya-Mutated Leader Algorithm (Jaya-MLA), which is formed by integration of Jaya Optimization and Mutated Leader Algorithm (MLA). This article’s processes included for intrusion detection are data pre-processing, feature fusion, and data augmentation. Here, data pre-processing is done by Z-score normalization, feature fusion is done by deep neural network (DNN) with correlation coefficient, and data augmentation is carried out by oversampling based Synthetic Minority Oversampling Technique (SMOTE). Moreover, DFFNN-based Jaya-MLA detected intrusions and classified them into five types. Furthermore, intrusion is detected, and the model’s performance is enhanced by evaluating it with three evaluation metrics, like F1-score, recall, and precision with values of 0.948, 0.939, and 0.961.

Analysis of Neural Network Intrusion Detection Methods and Datasets for their Training

Approaches based on neural network classifiers to the detection of computer attacks are considered. The problems of training such classifiers are discussed. Data sets on computer attacks for wired and wireless systems are considered. The results of evaluating such sets by the degree of imbalance are given. The problems of learning on unbalanced data sets and approaches to balancing the training set in the case of rare attacks, including those using generative adversarial networks, are described.

An optimized radial bias function neural network for intrusion detection of distributed denial of service attack in the cloud

SummaryCloud system is a set of resources meant to provide cloud customers with on‐demand services. Accessibility to cloud environment is provided through internet services, making data stored on cloud more accessible to attackers internally and externally. Several intrusion detection systems and authentication methods have been developed in previous studies to identify the intruders, however they are generally unsuccessful with certain drawbacks. Numerous existing researchers have focused on machine learning techniques for identifying intrusions. This article intends to introduce a new intrusion detection model in the cloud and it involves three processes like preprocessing, feature extraction and detection. Initially, preprocessing takes place and the preprocessed data are subjected to feature extraction process. The flow‐based features, statistical, and higher‐order statistical features with improved holoentropy features, and the technical indicators are extracted. After extracting the features, they are subjected to a detection process, where the optimized radial bias function neural network (RBF‐NN) is exploited. For precise detection, the weight of RBF‐NN is tuned optimally by (harmonic mean based poor and rich optimization) HMPRO Algorithm. The main aim of the proposed model is to detect attacks in the cloud. Finally, the performance of the presented scheme is computed over the existing approaches using the CICDDoS2019 and UNSW‐NB_15 dataset in terms of different metrics.

Correlation between Deep Neural Network Hidden Layer and Intrusion Detection Performance in IoT Intrusion Detection System

As the Internet of Things (IoT) continues to grow, a vast amount of data is generated. The IoT environment is quite sensitive to security challenges because personal information may be leaked or sensor data may be manipulated, which could cause accidents. Because traditional intrusion detection system (IDS) studies are often designed to work well on datasets, it is unknown whether they would work well in a changing network environment. In addition, IDSs for protecting IoT environments have been studied, but their performance was verified using datasets unrelated to the IoT, so it is not known whether the performance would be effective in an IoT environment. In this study, we propose an intrusion detection hyperparameter control system (ID-HyConSys) that automates the IDS using proximal policy optimization (PPO) to solve these problems and reliably protect the IoT environment. ID-HyConSys consists of an intrusion detection module consisting of a deep neural network (DNN) feature extractor that extracts efficient features from a changing network environment, a k-means cluster that clusters the extracted data, and a PPO agent that automates the IDS through learning and control. Through experimentation, it was confirmed that the hidden layer configuration, the number of feature extractions by the DNN feature extractor, and the number of clusters in the k-means cluster significantly affected the intrusion detection performance. The PPO directly controls these hyperparameters and determines the optimized value itself. The performance of ID-HyConSys was evaluated using the CICIDS2017 and MQTTset datasets. An F1-score of 0.9707 on CICIDS2017 and an F1-score of 0.9973 on the MQTTset were obtained. Finally, we merged the two datasets and obtained an F1-score of 0.9901. The superiority of the ID-HyConSys proposed in this study was confirmed because ID-HyConSys showed high performance on each dataset and, at the same time, very high performance on complex merged datasets. ID-HyConSys is expected to protect the IoT environment more quickly and safely by automatically learning network changes and adjusting the intrusion detection module accordingly.