Proposed Intrusion Detection System Research Articles

Computer network big data detection based on internet of things technology

In order to solve the problems of traditional network security intrusion detection system in detection accuracy and missed detection rate, this paper proposes a computer network data detection based on Internet of things technology. This paper designs an intrusion detection system based on data clustering analysis algorithm. The hardware part of the intrusion detection system is composed of six parts: detection module, adaptive module, control management module, risk early warning module, control access module and data acquisition module. Each module is closely connected and updated with the rule base and database in real time; In the software flow design of the system, based on the data clustering analysis algorithm, the collected original data are classified and processed, and the Mings distance is determined, revealing the difference between normal data and abnormal data, and finally realizing the accurate detection of cloud computing network intrusion behavior. The experimental results show that the proposed intrusion detection system has a higher detection accuracy for malicious data, and the average missed detection rate can be controlled below 0.3 %. Conclusionthe detection system designed in this paper has more advantages in stability performance.

A secure edge computing model using machine learning and IDS to detect and isolate intruders

The article presents a secure edge computing model that utilizes machine learning for intrusion detection and isolation. It addresses the security challenges arising from the rapid expansion of IoT and edge computing. The proposed Intrusion Detection System (IDS) combines Linear Discriminant Analysis (LDA) and Logistic Regression (LR) to swiftly and accurately identify intrusions without alerting neighboring devices. The model outperforms existing solutions with an accuracy of 96.56%, precision of 95.78%, and quick training time (0.04 s). It is effective against various types of attacks, enhancing the security of edge networks for IoT applications.•The methodology employs a hybrid model that combines LDA and LR for intrusion detection.•Machine learning techniques are used to analyze and identify intrusive activities during data acquisition by edge nodes.•The methodology includes a mechanism to isolate suspected devices and data without notifying neighboring edge nodes to prevent intruders from gaining control over the edge network.

A Proposed Intrusion Detection System Based on an Improved Random Forest Using a Double Feature Selection Method

A Proposed Intrusion Detection System Based on an Improved Random Forest Using a Double Feature Selection Method

Intrusion detection system for cyberattacks in the Internet of Vehicles environment

This paper presents a novel framework for intrusion detection specially designed for cyberattacks, such as Denial-of-Service, Distributed Denial-of-Service, Distributed Reflection Denial-of-Service, Brute Force, Botnets, and Sniffing, on vehicles that are situated in the Internet of Vehicles environment. We propose an intrusion detection system based on machine learning that is capable of detecting abnormal behavior by examining network traffic to find unusual data flows. In this paper, we have presented a strategy for intrusion detection through a careful evaluation and selection of the most effective techniques for the following steps of the machine learning process: (i) data preprocessing by using Z-score normalization that preserves the data distribution for the proposed method and handles outliers; (ii) feature selection by using a regression model that simplifies the model complexity and reduces the execution time; and (iii) model selection and training – Random Forest, Extreme Gradient Boosting, Categorical Boosting, Light Gradient Boosting Machine – with hyperparameter optimization to control the behavior in the training phase and to prevent overfitting. The effectiveness of the proposed solution is demonstrated by extensive numerical experiments carried out using the well-known standard datasets CIC-IDS-2017, CSE-CIC-IDS-2018, and CIC-DDoS-2019, both separately and merged. We achieved a high accuracy above 99.8% within a running time of 46.9 s and 0.24 s detection time for the three combined intrusion detection system datasets, thereby showing that the proposed intrusion detection system outperforms the previous methods introduced in the literature.

A novel hybrid technique using fuzzy logic, neural networks and genetic algorithm for intrusion detection system

As the number of people who use the internet continues to rapidly increase, security has become an increasingly important concern in the online world. Many researchers in the past have developed detection systems to identify and detect intruders using data mining. These systems can be found in use today. However, the existing methods had the disadvantages in terms of detection accuracy and time overhead. To enhance the IDS detection accuracy and reduces the required time a novel intrusion detection system is proposed that will ensure the safety of data communication by locating any unauthorized users and efficiently identifying any unwanted visitors to wireless networks. In this paper, a hybrid algorithm is proposed for the removal of uncertainty and the prediction of outcomes. Fuzzy logic is utilized in the process of removing uncertainty, whereas neural networks are utilized for the purpose of prediction. The Genetic Algorithm is utilized in order to effect improvements in the accuracy of prediction results. Experiments have been carried out in order to evaluate the proposed intrusion detection system, which has an overall detection accuracy of 99.12 %. The proposed model's performance has been put to evaluation utilizing tenfold cross-validation, which has been completed.

The Proposed Intrusion Detection System using Support Vector Machine by IOT Enabled WSN

Abstract: Detecting intruders in computer networks is very important because it affects multiple communication and security domains finding network intruders can be difficult furthermore network intrusion detection remains a challenging undertaking due to the large amount of data required to train modern machine learning models to detect network intrusion risks recently many methods have been published for detecting network intruders however they face significant challenges as new threats continue to emerge that are undetectable by older systems this study evaluates different approaches to creating network intrusion detection systems the best features of the dataset are selected based on the correlations between features in addition we provide a complete functional and performance overview of an adaboost-based network attack detection solution based on these selected characteristics.

The Proposed Intrusion Detection System using Support Vector Machine by IOT enabled WSN: A Survey

Abstract: Detecting intruders in computer networks is very important because it affects multiple communication and security domains finding network intruders can be difficult furthermore network intrusion detection remains a challenging undertaking due to the large amount of data required to train modern machine learning models to detect network intrusion risks recently many methods have been published for detecting network intruders however they face significant challenges as new threats continue to emerge that are undetectable by older systems this study evaluates different approaches to creating network intrusion detection systems the best features of the dataset are selected based on the correlations between features in addition we provide a complete functional and performance overview of an adaboost-based network attack detection solution based on these selected characteristics.

Data driven intrusion detection for 6LoWPAN based IoT systems

Wide adoption of Internet of Things (IoT) devices and their limitations in terms of hardware cause them to be easy targets for attackers. This, in turn, requires monitoring such systems using intrusion detection systems and take mitigative actions against insider and outsider attackers. Recent studies have explored that machine learning based intrusion detection systems are quite successful in detecting different types of cyber threats targeting IoT systems. However, the proposed systems in these studies incurred limitations in terms of the characteristics of their datasets and detection models. Specifically, a big proportion of the proposed models were developed using simulation-based data generated through specific simulators. Some of these studies also used previously published testbed data that contain the samples of outdated IoT attacks and vulnerabilities. Furthermore, they focused on a lower attack variety and proposed binary classifiers which do not scale in multi-attack scenarios. In this study, we propose a machine learning based multi-class classifier that can classify 6 attack types together with the benign traffic. Our node based feature extraction and detection methodology allows locating the network addresses of the attackers, rather than a rough network level attack existence information, by modeling their traffic characteristics over a sliding time window. For training and testing our models, we also propose an intrusion detection dataset generated using the traffic data collected from real IoT devices running with 6LoWPAN and RPL protocols. Besides having RPL routing attacks in the dataset, we leverage Mirai botnet, employed frequently to target IoT devices. The results show that the proposed intrusion detection system can detect 6 attack types with high recall scores ranging from 79% to 100%. We also illustrate the practicality of the developed model via deployment in a proof of concept implementation over a testbed.

A Novel Deep Learning-Based Intrusion Detection System for IoT Networks

The impressive growth rate of the Internet of Things (IoT) has drawn the attention of cybercriminals more than ever. The growing number of cyber-attacks on IoT devices and intermediate communication media backs the claim. Attacks on IoT, if they remain undetected for an extended period, cause severe service interruption resulting in financial loss. It also imposes the threat of identity protection. Detecting intrusion on IoT devices in real-time is essential to make IoT-enabled services reliable, secure, and profitable. This paper presents a novel Deep Learning (DL)-based intrusion detection system for IoT devices. This intelligent system uses a four-layer deep Fully Connected (FC) network architecture to detect malicious traffic that may initiate attacks on connected IoT devices. The proposed system has been developed as a communication protocol-independent system to reduce deployment complexities. The proposed system demonstrates reliable performance for simulated and real intrusions during the experimental performance analysis. It detects the Blackhole, Distributed Denial of Service, Opportunistic Service, Sinkhole, and Workhole attacks with an average accuracy of 93.74%. The proposed intrusion detection system’s precision, recall, and F1-score are 93.71%, 93.82%, and 93.47%, respectively, on average. This innovative deep learning-based IDS maintains a 93.21% average detection rate which is satisfactory for improving the security of IoT networks.

Maximizing Anomaly Detection Performance in Next-Generation Networks

The paper discusses major components of the proposed intrusion detection system as well as associated ideas. Dimensionality reduction solutions are highly valued for their potential to improve the efficiency of anomaly detection. Furthermore, feature selection and fusion methods are applied to optimise the system's capabilities. The following summary of network control, management, and cloud-based network processing aspects highlights operations managers, cloud resources, network function virtualization (NFV), and hardware and software components. We discuss prospective Deep Autoencoders (DAEs) applications, such as their use in the dimensionality reduction module, training methodologies, and benefits. Data transformation utilising coded representations is also graphically displayed and described in the text using an encoder and decoder system. The role of the anomaly detection via virtual network function in the suggested technique is also investigated. This component leverages a deep neural network (DNN) to identify anomalies in the 5G network's peripherals. DNN design issues, optimisation methodologies, and the trade-off between model complexity and detection efficacy are also discussed. Overall, the passage provides an overview of the proposed intrusion detection scheme, its components, and the techniques employed, underscoring their contributions to improving efficiency, accuracy, and security in Next Generation Networks.

An Enterprise of Cognitive Fog Computing For Disturbance Recognition in Internet of Things

The Internet of Things (IoT) is a cutting-edge piece of cybernetic infrastructure that will eventually link all manner of previously disconnected physical objects to the web. The IoT is rapidly expanding into many facets of human life. IoT's attack surface has grown as a result of the technology's hyper-connectivity and inherent heterogeneity. In addition, IoT devices are used in both managed and unmanaged settings, leaving them open to innovative attacks. Fog computing is used in the proposed intrusion detection system for IoT applications to implement intrusion detection in a decentralised manner. Attack detection at fog nodes and summarization on a cloud server make up the proposed system's two parts. The local fog nodes in the IoT environment examine the traffic, and then they send a report to the cloud server that summarises the current global security state of the IoT application. According to the results of the experiments, the fog nodes are able to identify the attack 27% more quickly while also reducing the number of false alarms. The work that has been recommended provides a beginning point for the creation of a fog-based intrusion detection system that can be used for applications related to the IoT. The proposed system has a false alarm rate of only 0.32% and an accuracy of 98.15 percent. The proposed method can only identify attacks that conform to specific patterns.

Adam Improved Rider Optimization-Based Deep Recurrent Neural Network for the Intrusion Detection in Cyber Physical Systems

This paper designed the intrusion detection systems for determining the intrusions. Here, Adam Improved rider optimization approach (Adam IROA) is newly developed for detecting the intrusion in intrusion detection. Accordingly, the training of DeepRNN is done by proposed Adam IROA, which is designed by combining the Adam optimization algorithm with IROA. Thus, the newly developed Adam IROA is applied for intrusion detection. Overall, two phases are included in the proposed intrusion detection system, which involves feature selection and classification. Here, the features selection is done using proposed WWIROA to select significant features from the input data. The proposed WWIROA is developed by combining WWO and IROA. The obtained features are fed to the classification module for discovering the intrusions present in the network. Here, the classification is progressed using Adam IROA-based DeepRNN. The proposed Adam IROA-based DeepRNN achieves maximal accuracy of 0.937, maximal sensitivity of 0.952, and maximal specificity of 0.908 based on SCADA dataset.

Statistical Analysis of Different Artificial Intelligent Techniques applied to Intrusion Detection System

Intrusion detection is the act of detecting unwanted traffic on a network or a device. Several types of Intrusion Detection Systems (IDS) technologies exist due to the variance of network configurations. Each type has advantages and disadvantage in detection, configuration, and cost. In general, the traditional IDS relies on the extensive knowledge of security experts, in particular, on their familiarity with the computer system to be protected. To reduce this dependence, various datamining and machine learning techniques have been used in the literature. The experiments and evaluations of the proposed intrusion detection system are performed with the NSL-KDD intrusion detection dataset. We will apply different learning algorithms on NSL-KDD data set, to recognize between normal and attack connections and compare their performing in different scenariosdiscretization, features selections and algorithm method for classification- using a powerful statistical analysis: ANOVA. In this study, both the accuracy of the configuration of different system and methodologies used, and also the computational time and complexity of the methodologies are analyzed.

Attack Detection in Power Distribution Systems Using a Cyber-Physical Real-Time Reference Model

This paper develops a novel intrusion detection system for power distribution systems that utilizes a cyber-physical real-time reference model to accurately replicate the complex behavior of power distribution components for attack detection. The proposed intrusion detection system analyzes the consistency of the physical data from sensor readings and control commands in contrast with their digital counterpart obtained from the real-time reference model. Therefore, a residual-based online attack detection mechanism that utilizes the chi-square test is able to determine the presence of malicious data. The proposed mechanism is implemented on a hardware-in-the-loop simulation testbed on a test power distribution system with distributed energy resources and energy storage systems. The results show that the proposed solution is able to quickly detect multiple types of cyber attacks for different levels of accuracy of the real-time reference model. The simulations illustrate that the proposed approach outperforms conventional attack detection mechanisms such as one-class classifiers and residual-based approaches that utilize Kalman filters or neural networks.

MSDAR: Multi-Stage Dynamic Architecture Intrusion Detection System

Ad hoc networks have been through extensive research in the last decade. Even with their desirable characteristics, major issues related to their security need to be considered. Various security solutions have been proposed to reduce the risks of malicious actions. They mainly focus on key management, authentication, secure localization, and aggregation techniques. These techniques have been proposed to secure wireless communications but they can only deal with external threats. Therefore, they are considered the first line of defense. Intrusion detection systems are always required to safeguard ad hoc networks as such threats cannot be completely avoided. In this paper, we present a comprehensive survey on intrusion detection systems in ad hoc networks. The intrusion detection systems and components and taxonomy as well as different implementations and types of IDSs are studied and categorized. In addition, we provide a comparison between different Intrusion Detection Systems’ architectures. We also propose a Multi Stage Dynamic Architecture intrusion detection system (MSDAR), designed with a multi-stage detection approach making use of both signature-based and anomaly detection benefits. Our proposed intrusion detection system MSDAR is featured by its dynamic architecture as it can be deployed in the network using the Distributed Hierarchical Architecture. The viability and performance of the proposed system MSDAR are tested against the Distributed Denial of Service Attacks through simulations. Advanced performance parameters were used to evaluate the proposed scheme MSDAR. Experimental results have shown that the performance of MSDAR improves by using multiple stages of different detection mechanisms. In addition, based on simulations, the Detection Rate increases when the sensitivity level increases.

Cyber-Attack Detection and Mitigation Using SVM for 5G Network

5G technology is widely seen as a game-changer for the IT and telecommunications sectors. Benefits expected from 5G include lower latency, higher capacity, and greater levels of bandwidth. 5G also has the potential to provide additional bandwidth in terms of AI support, further increasing the benefits to the IT and telecom sectors. There are many security threats and organizational vulnerabilities that can be exploited by fraudsters to take over or damage corporate data. This research addresses cybersecurity issues and vulnerabilities in 4G(LTE) and 5G technology. The findings in this research were obtained by using primary and secondary data. Secondary data was collected by reviewing literature and conducting surveys. Primary data were obtained by conducting an experimental simulation using the support vector machine (SVM) approach. The results show that cybersecurity issues related to 4G and 5G need to be addressed to ensure integrity, confidentiality, and availability. All enterprises are constantly exposed to a variety of risks. Also implemented an efficient SVM-based attack detection and mitigation system for 5G network. The proposed intrusion detection system defends against security attacks in the 5G environment. The results show that the throughput and intrusion detection rate is higher while the latency, energy consumption, and packet loss ratio are low, indicating that the proposed intrusion detection and defense system has achieved better QoS. The security solutions are fast and effective in detecting and mitigating cyber-attacks.

An Intelligent Hierarchical Security Framework for VANETs

Vehicular Ad hoc Networks (VANETs) are an emerging type of network that increasingly encompass a larger number of vehicles. They are the basic support for Intelligent Transportation Systems (ITS) and for establishing frameworks which enable communication among road entities and foster the development of new applications and services aimed at enhancing driving experience and increasing road safety. However, VANETs’ demanding characteristics make it difficult to implement security mechanisms, creating vulnerabilities easily explored by attackers. The main goal of this work is to propose an Intelligent Hierarchical Security Framework for VANET making use of Machine Learning (ML) algorithms to enhance attack detection, and to define methods for secure communications among entities, assuring strong authentication, privacy, and anonymity. The ML algorithms used in this framework have been trained and tested using vehicle communications datasets, which have been made publicly available, thus providing easily reproducible and verifiable results. The obtained results show that the proposed Intrusion Detection System (IDS) framework is able to detect attacks accurately, with a low False Positive Rate (FPR). Furthermore, results show that the framework can benefit from using different types of algorithms at different hierarchical levels, selecting light and fast processing algorithms in the lower levels, at the cost of accuracy, and using more precise, accurate, and complex algorithms in nodes higher in the hierarchy.

An Ensemble of Prediction and Learning Mechanism for Improving Accuracy of Anomaly Detection in Network Intrusion Environments

The connectivity of our surrounding objects to the internet plays a tremendous role in our daily lives. Many network applications have been developed in every domain of life, including business, healthcare, smart homes, and smart cities, to name a few. As these network applications provide a wide range of services for large user groups, the network intruders are prone to developing intrusion skills for attack and malicious compliance. Therefore, safeguarding network applications and things connected to the internet has always been a point of interest for researchers. Many studies propose solutions for intrusion detection systems and intrusion prevention systems. Network communities have produced benchmark datasets available for researchers to improve the accuracy of intrusion detection systems. The scientific community has presented data mining and machine learning-based mechanisms to detect intrusion with high classification accuracy. This paper presents an intrusion detection system based on the ensemble of prediction and learning mechanisms to improve anomaly detection accuracy in a network intrusion environment. The learning mechanism is based on automated machine learning, and the prediction model is based on the Kalman filter. Performance analysis of the proposed intrusion detection system is evaluated using publicly available intrusion datasets UNSW-NB15 and CICIDS2017. The proposed model-based intrusion detection accuracy for the UNSW-NB15 dataset is 98.801 percent, and the CICIDS2017 dataset is 97.02 percent. The performance comparison results show that the proposed ensemble model-based intrusion detection significantly improves the intrusion detection accuracy.

PCA-based Hotelling's T2 chart with fast minimum covariance determinant (FMCD) estimator and kernel density estimation (KDE) for network intrusion detection

In this work, the combination between the Principal Component Analysis (PCA) and the Hotelling’s T2 chart is proposed to solve problems caused by the many highly correlated network traffic features and to reduce the computational time without reducing its accuracy detection. However, a new issue arises due to the difficulty of the network traffic observations to follow the multivariate normal distribution as required in Hotelling’s T2 chart. Consequently, many false alarms are found in inspecting network intrusion detection. To solve this issue, the Kernel Density Estimation (KDE) procedure is applied to obtain an optimum control limit. Also, to improve the accuracy detection, the Fast Minimum Covariance Determinant (FMCD) is employed to estimate the robust mean vector and covariance matrix. Experiments using the simulated dataset are conducted to assess the proposed chart’s performance in detecting the presence of outlier for the normal and non-normal of multivariate data. According to the simulation studies, the proposed chart yields higher accuracy and a high detection rate with a low false alarm rate. Further, the proposed Intrusion Detection System (IDS) is utilized in scanning attacks. The reputable KDD99 data is used as the benchmark to make a fair comparison between the proposed IDS and some algorithms. The monitoring outputs show that the proposed approach produces advancements in the speed of computational time with 87.42% of time efficiency. Compared to the other charts in detecting intrusion, the proposed chart produces the lower False Negative Rate (FNR). Also, compared to some classifiers the proposed chart yields a higher accuracy at about 0.9893.

A novel GPU based intrusion detection system using deep autoencoder with Fruitfly optimization

Intrusion Detection Systems (IDSs) have received more attention to safeguarding the vital information in a network system of an organization. Generally, the hackers are easily entering into a secured network through loopholes and smart attacks. In such situation, predicting attacks from normal packets is tedious, much challenging, time consuming and highly technical. As a result, different algorithms with varying learning and training capacity have been explored in the literature. However, the existing Intrusion Detection methods could not meet the desired performance requirements. Hence, this work proposes a new Intrusion Detection technique using Deep Autoencoder with Fruitfly Optimization. Initially, missing values in the dataset have been imputed with the Fuzzy C-Means Rough Parameter (FCMRP) algorithm which handles the imprecision in datasets with the exploit of fuzzy and rough sets while preserving crucial information. Then, robust features are extracted from Autoencoder with multiple hidden layers. Finally, the obtained features are fed to Back Propagation Neural Network (BPN) to classify the attacks. Furthermore, the neurons in the hidden layers of Deep Autoencoder are optimized with population based Fruitfly Optimization algorithm. Experiments have been conducted on NSL_KDD and UNSW-NB15 dataset. The computational results of the proposed intrusion detection system using deep autoencoder with BPN are compared with Naive Bayes, Support Vector Machine (SVM), Radial Basis Function Network (RBFN), BPN, and Autoencoder with Softmax.Article HighlightsA hybridized model using Deep Autoencoder with Fruitfly Optimization is introduced to classify the attacks.Missing values have been imputed with the Fuzzy C-Means Rough Parameter method.The discriminate features are extracted using Deep Autoencoder with more hidden layers.