Intrusion Detection Rate Research Articles

A Novel Feature based Unified Node Data Analysis (FBU-NDA) based IDS using AODV in MANET

MANET is a type of wireless network, which works on radio frequencies and holds short range communication. As it is temporary in nature and is having movable devices for communication which makes such network as infrastructure less. In such network variable conditions of routing will face several issues which degrade its performance. Out of these securities is the major concern which deals with all the type of attacks & data packet security. Thus the node which is involved in such type of security breaches is called as malicious or misbehaving nodes & the mechanism used to prevent that comes under intrusion detection system. These intrusions can be prevented by various mechanisms like acknowledgement, monitoring nodes, behavior detections, data dropping & modifications, delay reductions etc. All the existing routing protocol assumes that the nodes within the range is behaving properly because they had not considered the mobility & network scenarios adoptions due to newly identified nodes. Our prime concern by proposing new updates for security is to demonstrate higher intrusion detection rates with minimized performance issues. This work proposes a new improved Feature Based Unified Node Data Analysis (FBU-NDA) Based IDS through AACK for AODV protocol. This quantity of response can be taken as major consideration for identification of intruder’s node.

Intrusion detection model with twin support vector machines

Intrusion detection system (IDS) is becoming a critical component of network security. However, the performance of many proposed intelligent intrusion detection models is still not competent to be applied to real network security. This paper aims to explore a novel and effective approach to significantly improve the performance of IDS. An intrusion detection model with twin support vector machines (TWSVMs) is proposed. In this model, an efficient algorithm is also proposed to determine the parameter of TWSVMs. The performance of the proposed intrusion detection model is evaluated with KDD’99 dataset and is compared with those of some recent intrusion detection models. The results demonstrate that the proposed intrusion detection model achieves remarkable improvement in intrusion detection rate and more balanced performance on each type of attacks. Moreover, TWSVMs consume much less training time than standard support vector machines (SVMs).

Traffic-and-resource-aware intrusion detection in wireless mesh networks

As the interest in Wireless Mesh Networks (WMN), as an infrastructureless wireless network, grows, security issues, especially intrusion detection, become of paramount importance. The diversity in hardware along with a variety of WMN applications, have resulted in WMN with different network characteristics (e.g., resource levels, system and security models, etc.). Consequently, different intrusion detection mechanisms have been proposed by the research community. Recently, the community has proposed several monitoring techniques for intrusion detection where each considers different assumptions and presents a different problem formulation for optimal monitoring. This article proposes a taxonomy that categorizes existing solutions in this research area and identifies the similarities and differences in their optimal monitoring problem formulations. We then concentrate on two classes of monitoring techniques for intrusion detection in WMN: Traffic Agnostic and Resourceful and Traffic Aware and Resourceful and present centralized and distributed algorithms for solving optimal monitoring problem in these networks. Through extensive simulations and a real implementation, we demonstrate the effects of different network characteristics on the problem formulation and consequently the performance (e.g., intrusion detection rate and resource consumption) of proposed solutions for optimal monitoring in WMN.

A New Data Stream Clustering Approach about Intrusion Detection

Intrusion detection is one of the most important techniques for protecting network security. In addition, intrusion detection model can be used to recognize real-time pattern, which has important practical significance for real-time intrusion detection. However, due to the sheer speed and scale of the data, data points must often be analyzed in real time. The one-pass-through requirement and the lack of efficient clustering algorithms to identify intrusion patterns limit the power and scalability of this approach. A data stream clustering algorithm is proposed for real-time network intrusion detection. By introducing the new hashing mechanism, the method can quickly find the clustering patterns in the data stream. The method significantly reduces the false alarm rate of intrusion detection, and improves the performance of intrusion detection system.

Clustering and Hybrid Genetic Algorithm based Intrusion Detection Strategy

Ad hoc networks face serious security threat due to its inherent weaknesses. Intrusion detection is crucial technology in protecting the security of Ad hoc networks. Recently, Intrusion Detection Systems (IDS) face open issues, such as how to make use of intrusion detection technologies to excavate normal/abnormal behaviors from a lot of initialized data and dig out invasion models later for intrusion detection automatically and effectively. In this paper, we propose an enhanced algorithm combined improved clustering algorithm with Hybrid Genetic Algorithm (HGA), called Enhanced Intrusion Detection Algorithm (EIDA) for intrusion detection in Ad hoc networks. Clustering Algorithm is used to divide the normal/anomalous data from network and system behaviors. Then HGA is used to dig out the invasion rules. Our EIDA is an unsupervised anomaly detection algorithm. The experiment result shows that it is extensible and not sensitive to the sequence of the input data sets. It has the capacity to deal with different types of data and detection rate and false positive rate of intrusion detection has been improved effectively. DOI : http://dx.doi.org/10.11591/telkomnika.v12i1.3353

A Review of Feature Reduction in Intrusion Detection System Based on Artificial Immune System and Neural Network

Feature reduction plays an important role in intrusion detection system. The large amount of feature in network as well as host data effect the performance of intrusion detection method. Various authors are research proposed a method of intrusion detection based on machine learning approach and neural network approach, but all of these methods lacks in large number of feature attribute in intrusion data. In this paper we discuss its various method of feature reduction using artificial immune system and neural network. Artificial immune system is biological inspired system work as mathematical model for feature reduction process. The neural network well knows optimization technique in other field. In this paper we used neural network as feature reduction process. The feature reduction process reduces feature of intrusion data those are not involved in security threats and attacks such as TCP protocol, UDP protocol and ICMP message protocol. This reduces feature-set of intrusion improve the classification rate of intrusion detection and improve the speed performance of the intrusion detection system. The current research going on fixed and static number of feature reduction, we proposed an automatic and dynamic feature reduction technique using PCNN network.

Network Intrusion Detection Based on Artificial Immune Clustering

Traditional intrusion detection classification based methods could not tackle the abnormal events in a changing network environment, because those methods need lots of labeled data for training prediction. On the other hand, the clustering algorithm based methods could not get ideal prediction results. In this paper, a novel Intrusion detection algorithm based on immune clustering algorithm is proposed. This method could automatically establish clusters and calculate the outlier factor for each data item. The advantage of this method could select the top x% of items as intrusions according users’ choosing, so we could balance intrusion detection rate and the false negative rate in different application contexts. The experiment results show that this novel algorithm is effective for intrusion detection problem.

An Attribute-weighted Clustering Intrusion Detection Method

Intrusion detection system is automatic system which recognize intrusions of computers or computer network systems. The existing security detection systems have many problems such as wrong detection of intrusions, false intrusions, poor real-time performance. To solve these problems, this paper improves the particle swarm optimization algorithm and presents an attribute-weighted distance calculation method based on information gain ratio. This method for the division of spherical or ellipsoidal data can obtain better clustering results. And the data set of KDD-cup 99 is used as the experimental data. The experimental results show that the method can detect many kinds of known network intrusion and also can detect many unknown network intrusions. At the same time, the method can maintain the higher intrusion detection rate and lower false alarm rate.

A Fast Construction of Intrusion Relieved Communication Path based on Trust level and Heuristic Search

Adhoc network is subjected to many malicious activities and security threatens because of its wide distribution and heterogeneous nature. Intrusion is one among such activities that comprise confidentiality, integrity or availability of resources. Numerous efforts have been made in the literature to detect intrusion in an Adhoc network, however less number of efforts have been put to construct an intrusion relieved network. In the previous work, we proposed a methodology to construct an intrusion relieved network based on trust level of every node. The methodology used Rotboost algorithm to estimate the trust level of every node in the upcoming instants. As the learning of Rotboost requires more time, we planned to incorporate a fast learning algorithm to improve the efficiency of the methodology. Moreover, this paper introduces an efficient heuristic search algorithm to find the shortest path instead Dijkstra algorithm. As Dijkstra is time consuming in determining shortest possible network paths, it ultimately affects the efficiency of constructing intrusion free path. Replacing Dijkstra by heuristic search algorithm can lead to better performance in terms of computational complexity and the intrusion free path can be constructed in an efficient way. Hence a modified architecture for intrusion detection and intrusion free path detection is constructed and simulated. The simulation results show that the modified architecture outperforms the conventional architecture in terms of intrusion detection rate, path costs and computational times. KeywordsHeuristic, Path Identifier, Fast learning, Rotboost intelligence 1. INTRODUCTIONnetwork is a group of temporary nodes that is competent of enthusiastically forming a momentary network without the support of any centralized unchanging infrastructure. Self- organized and adaptive are the most important features of an adhoc network. A rising number of security threats are exposed by the computer adhoc networks and internet. For network system, more responsive information is being stored as security and is becoming more and more important (1). With the constantly appearing new types of attacks, increasing stretchy and adaptive safety measures oriented approaches is a strict challenge (2) and also it is led to enlarge in cyber-attacks which require the need for a successful intrusion detection system (3). Anderson has introduced the idea of intrusion detection in 1980 (7), Intrusion is defined as any set of deed that challenge to compromise the integrity, confidentiality or availability of system resources (3)(4). By taking into account of the information source an IDS may be either host or network-based. A host-based IDS analyzes proceedings such as process identifiers and system calls, mainly associated to OS information. But, a network-based IDS analyzes network connected events: traffic volume, IP addresses, service ports, protocol usage, etc (6.3), (2). To intrusion detection model as described in (5) misuse detection model and Anomaly detection model are two approaches. Detection of intrusions that follow definite intrusion patterns is referred as misuse detection model. It is very much useful in detecting known attack patterns. Anomaly detection model refers to detection performed by detecting changes in the patterns of operation or performance of the system. Known and unknown attacks can be detected by it. Many data mining approaches like clustering and discovering association rules, have been applied to intrusion detection (8)

Research on False Alarm Rate of Intrusion Detection based on Cloning Immune Method

Research on False Alarm Rate of Intrusion Detection based on Cloning Immune Method

New Intelligent Computer Intrusion Detection Method Using Hessian Local Linear Embedding and Multi-Kernel Support Vector Machine

Computer networks frequently collapse under the destructive intrusions. It is crucial to detection hidden intrusions to protect the computer networks. However, a computer intrusion often distributes high dimensional characteristic signals, which increases the difficulty of intrusion detection. Literature review indicates that limited work has been done to address the nonlinear dimension reduction problem in computer intrusion detection. Hence, this study has proposed a new intrusion detection method based on the Hessian Local Linear Embedding (HLLE) and multi-kernel Support Vector Machine (SVM). The HLLE was firstly used to reduce the dimension of the original intrusion date in a nonlinear manner. Then the SVM with multiply kernels was employed to detect the intrusions. A real computer network experimental system has been established to evaluate the proposed method. Four typical intrusions have been tested. The test results show high effectiveness of the new detection method. In addition, the new method has been compared with the single-kernel SVM with Local Linear Embedding (LLE) or Principal Component Analysis (PCA). The comparison results demonstrate that the proposed HLLE plus multi-kernel SVM can provide the best computer intrusion detection rate of 97.1%.

Network Intrusion Detection Based on the Improved Artificial Fish Swarm Algorithm

In order to predict network anomalies and get rid of the drawbacks of current detection, early prediction of abnormal for detecting early characteristics of the abnormal is introduced in the invasion anomaly detection process. First, the objective functions are constructed according to the feature subset dimensions and the detection accurate rates of the detection model. Then the artificial fish swarm algorithm is used to search the optimal feature subset and the chaotic, feedback mechanisms are introduced to improve the artificial fish swarm algorithm, the excessive intrusion feature rough sets produced in the classification process are simplified to guarantee the simplicity of characteristics and the estimation model for residuals gray level to predicate the early simplified invasion. Finally KDD1999 database is applied to testify the validity of the algorithm. The simulation results illustrate the improved artificial fish swarm algorithm can obtain the optimal intrusion feature subsets and reduce the dimensions of the feature subsets, which not only increase the network intrusion detection rates and reduce the errors, but also speed up the network abnormal intrusion detection.

Intrusion Detection Based on Improved SOM with Optimized GA

In order to improve the effectiveness of supervised self-organizing map (SSOM) neural network, a kind of genetic algorithm is designed to optimize it. To improve its classification rate, a real number encoding genetic algorithm is provided and used to optimize the learning rate and neighbor radius of SSOM. To speed up the modeling speed, a binary encoding genetic algorithm is provided to optimize input variables of SSOM and reduce its dimension of input sample. Finally, intrusion detection data set KDD Cup 1999 is used to carry out experiment based on the proposed model. The results show that the optimized model has shorter modeling time and higher intrusion detection rate.

Anomaly Intrusion Detection Based on Concept Lattice

In order to identify potential and effective intrusion detection rules, and improve the detection rate of intrusion detection system, this paper combines the concept lattice with intrusion detection technology and proposes a anomaly intrusion detection system based on concept lattice theory. The system first pre-treats those collected data, regulates data and builds concept lattice using the minimal set of attributes which are obtained by attribute reduction. And it analyzes the implication relations between concepts and obtains non-redundant classification rules. The anomaly intrusion detection model based compared with other tests can easily get training data. Experimental results show the model reduces the computation amount to achieve classification, improves the intrusion detection rate and effectively controls the false detection rate.

A novel intrusion detection framework for wireless sensor networks

Vehicle cloud is a new idea that uses the benefits of wireless sensor networks (WSNs) and the concept of cloud computing to provide better services to the community. It is important to secure a sensor network to achieve better performance of the vehicle cloud. Wireless sensor networks are a soft target for intruders or adversaries to launch lethal attacks in its present configuration. In this paper, a novel intrusion detection framework is proposed for securing wireless sensor networks from routing attacks. The proposed system works in a distributed environment to detect intrusions by collaborating with the neighboring nodes. It works in two modes: online prevention allows safeguarding from those abnormal nodes that are already declared as malicious while offline detection finds those nodes that are being compromised by an adversary during the next epoch of time. Simulation results show that the proposed specification-based detection scheme performs extremely well and achieves high intrusion detection rate and low false positive rate.

Efficient Intrusion Detection Based on Multiple Neural Network Classifiers with Improved Genetic Algorithm

The security of computer network is one of the most important issues for all the users. Intrusion may lead to terrible disaster for network users. Therefore, it is imperative to detect the network attacks to protect the information security. The intrusion patter identification is a hot topic in this research area. Using artificial neural networks (ANN) to provide intelligent intrusion recognition has been received a lot of attentions. However, the intrusion detection rate is often affected by the structure parameters of the ANN. Improper ANN model design may result in a low detection precision. To overcome these problems, a new network intrusion detection approach based on improved genetic algorithm (GA) and multi-ANN classifiers is proposed in this paper. The improved GA used energy entropy to select individuals to optimize the training procedure of the BPNN, RBF, PNN and Fuzzy-NN. Then, the satisfactory ANN models with proper structure parameters were attained. In addition, to alleviate the complexity of the input vector, the principal component analysis (PCA) has been employed to eliminate redundant features of the original intrusion data. The efficiency of the proposed method was evaluated with the practical data, and the experiment results show that the proposed approach offers a good intrusion detection rate, and performs better than the standard GA-ANN method.

Artificial Neural Network Based Intrusion Detection Method Combined with Manifold Learning Algorithm

Computer and network security is one of the most emergency issues for a large scale of applications. The unexpected intrusion may make terrible disaster to the network users. It is therefore imperative to detect the network attacks to prevent this kind of violations. The intrusion patter recognition is now a hot topic in this research area. The use of the artificial neural networks (ANN) can provide intelligent intrusion detection. However, the intrusion detection rate is often affected by the input feature vector of the ANN. This is because the original feature space always contains a certain number of useless features. To overcome this problem, a new network intrusion detection approach based on manifold learning nonlinear feature dimension descending and ANN classifier is presented in this paper. The locally linear embedding (LLE) algorithm was used to reduce the original intrusion feature space. Then the satisfactory ANN model with proper input features was obtained. The efficiency of the proposed method was evaluated with the real intrusion data. The analysis results show that the proposed approach has good intrusion detection rate, and performs better than the standard GA-ANN method.

A novel intrusion detection method based on improved SVM by combining PCA and PSO

The paper presents an improved support vector machine (SVM) by combining principal component analysis (PCA) and particle swarm optimization (PSO). Then, the improved SVM is applied to the intrusion detection system (IDS) to improve the detection rate. First, PCA is used to reduce the dimension of feature vectors. Second, we use the PSO algorithm to optimize the punishment factor C and kernel parameters σ in SVM. The experimental results indicate that the intrusion detection rate (97.752 8%) of improved SVM by combining PCA and PSO is higher than those (95.635 5%) of PSO-SVM and those (90.476 2%) of standard SVM with KDD Cup 1999 data set.

The Application of Improved Genetic Neural Network in IDS for Material Detecting

The basic idea of twice genetic algorithm optimization of BP neural network model(TGB)is rough selection network model using genetic algorithm, then use BP neural network to determine the parameters which can make the error function obtained the minimum and determine its position in the parameter space, then the genetic algorithm again to solve the problem of possible local minima.Feature selection is a new formulation of dimension reduction methods. It can simplify the size of neural network and improve real-time and the accuracy of the system.The simulation results TGB-based network intrusion detection algorithm improve intrusion detection rate of samples in different degrees. It can reduce significantly training time and test time. It further demonstrates the effectiveness and feasibility of this method. The study is very useful to detect materials. So from the analysis, you can learn some skills for materials detecting.

Design and Evaluation of a Weighted Intrusion Detection Method for VANETs

With the rapid proliferation of wireless networks and mobile computing applications, the landscape of the network security has greatly changed recently. Especially, Vehicular Ad Hoc Networks maintaining network topology with vehicle nodes of high mobility are self-organizing Peer-to-Peer networks that typically have short-lasting and unstable communication links. VANETs are formed with neither fixed infrastructure, centralized administration, nor dedicated routing equipment, and vehicle nodes are moving, joining and leaving the network with very high speed over time. So, VANET-security is very vulnerable for the intrusion of malicious and misbehaving nodes in the network, since VANETs are mostly open networks, allowing everyone connection without centralized control. In this paper, we propose a weighted intrusion detection method using rough set that can identify malicious behavior of vehicle node's activity and detect intrusions efficiently in VANETs. The performance of the proposed scheme is evaluated by a simulation study in terms of intrusion detection rate and false alarm rate for the threshold of deviation number .