Real-time Intrusion Detection System Research Articles

Подход к настройке CatBoost для продвинутого обнаружения атак DoS и DDoS в сетевом трафике

In the ever-evolving landscape of network security, the sophistication of cyber-attacks, especially Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, poses a formidable challenge to intrusion detection systems. Recognizing the longstanding application of CatBoost in various domains, this study explores its novel optimization for network intrusion detection, a critical area in need of advanced solutions. Leveraging the strengths of CatBoost in handling categorical data and imbalanced datasets, we meticulously adapt the classifier to meet the complex demands of distinguishing between DoS, DDoS, and benign traffic within the comprehensive CICIDS2017 and CSE-CIC-IDS2018 datasets. This research is an attempt to refine the learning efficiency and detection capabilities of CatBoost through the implementation of advanced feature selection and data preparation, contributing to the field by improving detection accuracy within real-time intrusion detection systems. The results show a notable improvement in performance, underscoring the classifier's role in advancing cybersecurity measures. Furthermore, the study paves the way for future exploration into adversarial machine learning and automated feature engineering, fortifying the resilience and adaptability of intrusion detection systems against the backdrop of a rapidly changing cyber threat landscape. These efforts provide solid approaches to address the current challenges in network security, signaling a move towards more refined and dependable intrusion detection methods.

Using Machine Learning Multiclass Classification Technique to Detect IoT Attacks in Real Time.

This paper presents a real-time intrusion detection system (IDS) aimed at detecting the Internet of Things (IoT) attacks using multiclass classification models within the PySpark architecture. The research objective is to enhance detection accuracy while reducing the prediction time. Various machine learning algorithms are employed using the OneVsRest (OVR) technique. The proposed method utilizes the IoT-23 dataset, which consists of network traffic from smart home IoT devices, for model development. Data preprocessing techniques, such as data cleaning, transformation, scaling, and the synthetic minority oversampling technique (SMOTE), are applied to prepare the dataset. Additionally, feature selection methods are employed to identify the most relevant features for classification. The performance of the classifiers is evaluated using metrics such as accuracy, precision, recall, and F1 score. The results indicate that among the evaluated algorithms, extreme gradient boosting achieves a high accuracy of 98.89%, while random forest demonstrates the most efficient training and prediction times, with a prediction time of only 0.0311 s. The proposed method demonstrates high accuracy in real-time intrusion detection of IoT attacks, outperforming existing approaches.

MEMFO-KELM: A Deep Learning Approach for Real-Time Intrusion Detection in Cloud Environments

With the increasing importance of network security in cloud environments, effective intrusion detection systems (IDS) are crucial for safeguarding data transmission and protecting against cyber attacks. This research proposes a novel IDS model named Mutation Enhanced Moth-Flame Optimization based Kernel Extreme Learning Machine (MEMFO-KELM) algorithm. The objective is to address the challenges associated with cloud environments and enhance the accuracy of intrusion detection in real-time scenarios. The MEMFO-KELM algorithm incorporates advanced techniques to improve classification performance and ensure accurate detection. The deep learning model architecture includes convolutional layers for capturing complex patterns, recurrent layers for modelling temporal dependencies, and fully connected layers for feature extraction. L1 regularization (Lasso) is applied to the fully connected layers to enhance interpretability and reduce model complexity. Here, four datasets are represented to validate the performance with different attacks and normal classes are implemented: MQTT-IoT-IDS2020, CSE-CIC-IDS2018, NSL-KDD, and Apache Web Server. The proposed IDS model achieves remarkable performance, with an accuracy of 98.4%, a false alarm rate of 0.056, a detection rate of 98%, and a computational time of 120 s. These results highlight the effectiveness of the MEMFO-KELM algorithm in accurately detecting intrusions. Comparative analysis reveals that the proposed real-time IDS model demonstrates its superiority compared to other methods. By addressing the challenges of cloud environments and incorporating advanced techniques, the MEMFO-KELM IDS model contributes to enhanced network security, mitigates the risks associated with cyber attacks, and ensures the integrity of globally distributed resources.

Hardware/Software Codesign of Real-Time Intrusion Detection System for Internet of Things Devices

Hardware/Software Codesign of Real-Time Intrusion Detection System for Internet of Things Devices

Surveillance System with Human Intrusion Detection

Security in restricted areas is essential for protecting valuable assets, sensitive information, ensuring the safety from intruders. Traditional security systems have many limitations, where they cannot authenticate whether the entered person is an intruder or not. To address this challenge by implementing a real-time face recognition- based surveillance system, is the goal of this project. Realtime Intrusion detection system provides surveillance for restricted and confidential areas with help of face recognition and detection, when an intruder or unauthorized person enters the area, this system will give an alert to the respective in charge through various channels, including email, messaging services, and direct phone calls. In this system, the OpenCV python library along with several algorithms are used to abstract the facial features and to take the input dataset. For face detection, the system utilizes SCRFD and YOLO, and it employs Arcface for accurate face recognition. This technique ensures the system can distinguish between an intruder and an authorized individual entering the secured area. This proactive approach enhances surveillance efficiency and reinforces the safety and integrity of restricted areas. For instance, when an individual enters the restricted area, the system captures and analyses their face. It then verifies whether the detected face matches any authorized faces in the registered user database. If there’s no match, the system identifies the person as an intruder and promptly sends an alert to the designated authority. To enhance accessibility, a user-friendly graphical interface (GUI) has been developed using Python’s Tkinter.

A Double-Layer Indemnity Enhancement Using LSTM and HASH Function Technique for Intrusion Detection System

The Intrusion Detection System (IDS) is the most widely used network security mechanism for distinguishing between normal and malicious traffic network activities. It aids network security in that it may identify unforeseen hazards in network traffic. Several techniques have been put forth by different researchers for network intrusion detection. However, because network attacks have increased dramatically, making it difficult to execute precise detection rates quickly, the demand for effectively recognizing network incursion is growing. This research proposed an improved solution that uses Long Short-Term Memory (LSTM) and hash functions to construct a revolutionary double-layer security solution for IoT Network Intrusion Detection. The presented framework utilizes standard and well-known real-time IDS datasets such as KDDCUP99 and UNSWNB-15. In the presented framework, the dataset was pre-processed, and it employed the Shuffle Shepherd Optimization (SSO) algorithm for tracking the most informative attributes from the filtered database. Further, the designed model used the LSTM algorithm for classifying the normal and malicious network traffic precisely. Finally, a secure hash function SHA3-256 was utilized for countering the attacks. The intensive experimental assessment of the presented approach with the conventional algorithms emphasized the efficiency of the proposed framework in terms of accuracy, precision, recall, etc. The analysis showed that the presented model attained attack prediction accuracy of 99.92% and 99.91% for KDDCUP99 and UNSWNB-15, respectively.

CAVIDS: Real time intrusion detection system for connected autonomous vehicles using logical analysis of data

In recent times, Connected Autonomous Vehicles (CAVs) have been gaining popularity and have already begun to revolutionize the transport industry, mainly using real-time monitoring, analysis and exchange of data through In-Vehicle Networks (IVN). IVN can also interact with the outside world and roadside infrastructures. With all these advantages, certain weaknesses also creep in as the communication in IVN lacks proper security measures like encryption and authentication. These lack of security measures in IVN makes CAVs vulnerable to cyber-attacks which may have fatal consequences. The de facto standard for communication in IVN is known as Controller Area Network or CAN, and it also lacks said security features to protect CAN from outside threats like cyber attacks, sensor tempering etc. Real-time intrusion detection with minimal computational resources is the need of the hour to prevent disruptive consequences and fatal crashes. In this paper, we propose an intrusion detection method based on Logical Analysis of Data (LAD) which facilitates real-time intrusion detection in CAVs using minimal computational resources. LAD is a two-class classification technique which uses the concept of a partially defined Boolean function (pdBf) to extract different rules for classification from a historical dataset consisting of CAN messages only. Usually, the normal behaviour of any CAV is specified using the extracted rules, and any unusual behaviour that does not conform with the extracted rules is treated as an anomaly. In this paper, we have extracted rules for anomaly and treated all behaviours that do not conform with these extracted rules as normal. The proposed method outperforms many state-of-the-art approaches, which include other rule-based methods, machine learning and deep learning methods both in terms of F1 score and detection time. For CarChallenge 2020 dataset, the proposed method requires lesser than 47.5 μs for detection using a Raspberry Pi device, which is far less than the average time difference between two consecutive CAN messages and thus can be considered as real-time intrusion detection. Real-time intrusion detection is important in preventing any untoward incidents in CAVs.

Real-Time Intrusion Detection and Prevention System for 5G and beyond Software-Defined Networks

The philosophy of the IoT world is becoming important for a projected, always-connected world. The 5G networks will significantly improve the value of 4G networks in the day-to-day world, making them fundamental to the next-generation IoT device networks. This article presents the current advances in the improvement of the standards, which simulate 5G networks. This article evaluates the experience that the authors gained when implementing Vodafone Romania 5G network services, illustrates the experience gained in context by analyzing relevant peer-to-peer work and used technologies, and outlines the relevant research areas and challenges that are likely to affect the design and implementation of large 5G data networks. This paper presents a machine learning-based real-time intrusion detection system with the corresponding intrusion prevention system. The convolutional neural network (CNN) is used to train the model. The system was evaluated in the context of the 5G data network. The smart intrusion detection system (IDS) takes the creation of software-defined networks into account. It uses models based on artificial intelligence. The system is capable to reveal not previously detected intrusions using software components based on machine learning, using the convolutional neural network. The intrusion prevention system (IPS) blocks the malicious traffic. This system was evaluated, and the results confirmed that it provides higher efficiencies compared to less overhead-like approaches, allowing for real-time deployment in 5G networks. The offered system can be used for symmetric and asymmetric communication scenarios.

DIDS: A Deep Neural Network based real-time Intrusion detection system for IoT

The number of people using the Internet of Things (IoT) devices has exploded in recent years. The instantaneous development in deploying constrained devices in numerous areas makes them vulnerable to assaults due to limited resources. Advanced cryptography cannot be constructed in these modest battery-powered devices. However, due to the unique properties of the constrained devices, current solutions are insufficient to protect the complete safety scope of IoT networks. An anomaly-based Intrusion Detection System (IDS) is used to identify and categorize assaults. Machine Learning (ML) and Deep Learning (DL) techniques, skilled in embedding intellect in IoT devices and networks, can address various security issues. In this article, we have proposed a deep neural network-based intrusion detection system to identify malicious packets in real-time. We have used newly developed benchmark Netflow-based datasets to train the model. We have proposed a packet capturing and detecting algorithm for real-time attack detection. We also demonstrate the accuracy of our suggested model.

Detecting Reconnaissance and Discovery Tactics from the MITRE ATT&CK Framework in Zeek Conn Logs Using Spark's Machine Learning in the Big Data Framework.

While computer networks and the massive amount of communication taking place on these networks grow, the amount of damage that can be done by network intrusions grows in tandem. The need is for an effective and scalable intrusion detection system (IDS) to address these potential damages that come with the growth of these networks. A great deal of contemporary research on near real-time IDS focuses on applying machine learning classifiers to labeled network intrusion datasets, but these datasets need be relevant pertaining to the currency of the network intrusions. This paper focuses on a newly created dataset, UWF-ZeekData22, that analyzes data from Zeek’s Connection Logs collected using Security Onion 2 network security monitor and labelled using the MITRE ATT&CK framework TTPs. Due to the volume of data, Spark, in the big data framework, was used to run many of the well-known classifiers (naïve Bayes, random forest, decision tree, support vector classifier, gradient boosted trees, and logistic regression) to classify the reconnaissance and discovery tactics from this dataset. In addition to looking at the performance of these classifiers using Spark, scalability and response time were also analyzed.

Host-based IDS: A review and open issues of an anomaly detection system in IoT

The Internet of Things (IoT) envisions a smart environment powered by connectivity and heterogeneity where ensuring reliable services and communications across multiple industries, from financial fields to healthcare and fault detection systems, is a top priority. In such fields, data is being collected and broadcast at high speed on a continuous and real-time scale, including IoT in the streaming processing paradigm. Intrusion Detection Systems (IDS) rely on manually defined security policies and signatures that fail to design a real-time solution or prevent zero-day attacks. Therefore, anomaly detection appears as a prominent solution capable of recognizing patterns, learning from experience, and detecting abnormal behavior. However, most approaches do not fit the urged requirements, often evaluated on deprecated datasets not representative of the working environment. As a result, our contributions address an overview of cybersecurity threats in IoT, important recommendations for a real-time IDS, and a real-time dataset setting to evaluate a security system covering multiple cyber threats. The dataset used to evaluate current host-based IDS approaches is publicly available and can be used as a benchmark by the community.

Deep Neural Network Based Real-Time Intrusion Detection System

In recent years, due to the rapid growth in network technology, numerous types of intrusions have been uncovered that differ from the existing ones, and the conventional firewalls with specific rule sets and policies are incapable of identifying those intrusions in real-time. Therefore, that demands the requirement of a real-time intrusion detection system (RT-IDS). The ultimate purpose of this research is to construct an RT-IDS capable of identifying intrusions by analysing the inbound and outbound network data in real-time. The proposed system consists of a deep neural network (DNN) trained using 28 features of the NSL-KDD dataset. In addition, it contains the machine learning (ML) pipeline with sequential components for categorical data encoding and feature scaling, which is used before transmitting the real-time data to the trained DNN model to make predictions. Moreover, a real-time feature extractor, which is a C++ program that sniffs data from the real-time network traffic and derives relevant data related to the features of the NSL-KDD dataset using the sniffed data, is deployed between the gateway router and the local area network (LAN). Together with the trained DNN model, the ML pipeline is hosted in a server that can be accessed via a representational state transfer application programming interface (REST API). The DNN has revealed outstanding testing performance results achieving 81%, 96%, 70% and 81% for accuracy, precision, recall and f1-score accordingly. This research comprises a comprehensive technical explanation concerning the implementation and functionality of the complete system. Moreover, leveraging the extensive explanations provided in this paper, advanced IDSs capable of identifying modern intrusions can be constructed.

Power information network intrusion detection based on deep learning and cloud computing

With the advent of the computer network era, people like to think in deeper ways and methods. In addition, the power information network is facing the problem of information leakage. The research of power information network intrusion detection is helpful to prevent the intrusion and attack of bad factors, ensure the safety of information, and protect state secrets and personal privacy. In this paper, through the NRIDS model and network data analysis method, based on deep learning and cloud computing, the demand analysis of the real-time intrusion detection system for the power information network is carried out. The advantages and disadvantages of this kind of message capture mechanism are compared, and then a high-speed article capture mechanism is designed based on the DPDK research. Since cloud computing and power information networks are the most commonly used tools and ways for us to obtain information in our daily lives, our lives will be difficult to carry out without cloud computing and power information networks, so we must do a good job to ensure the security of network information network intrusion detection and defense measures.

SwiftIDS: Real-time intrusion detection system based on LightGBM and parallel intrusion detection mechanism

High-speed networks are becoming common nowadays. Naturally, a challenge that arises is that the intrusion detection system (IDS) should timely detect attacks in huge volumes of traffic data produced by high-speed networks. Existing IDSs, however, mainly focus on improving detection rate and reducing false alarm rate, which are complicated and time-consuming. In this paper, we propose an IDS named SwiftIDS, which is capable of both analyzing massive traffic data in high-speed networks timely and keeping satisfactory detection performance. SwiftIDS achieves these goals by two approaches. One approach is that light gradient boosting machine (LightGBM) is adopted as the intrusion detection algorithm to handle the massive traffic data. The motivation of this approach is to not only take advantage of LightGBM’s effective detection performance, but also use its support for categorical features to simplify the data preprocessing. The other approach is that a parallel intrusion detection mechanism is utilized to analyze traffic data arriving in different time windows. In this way, the delay caused by the later-arriving data waiting for the end of the intrusion detection cycle of the first-arriving data can be avoided. The time efficiency and satisfactory detection performance of SwiftIDS are verified through the offline experiments on three benchmark datasets. Furthermore, we perform a near real-time experiment to provide more convincing proofs for the timeliness of SwiftIDS.

An optimized collaborative intrusion detection system for wireless sensor networks

In wireless sensor networks (WSNs), sensor nodes regularly monitor environment and transmit measured values for specific phenomena to a central point called base station (BS). Recently, many intrusion detection systems (IDSs) are proposed for WSNs as they are vulnerable to multiple types of attacks. Unfortunately, most of these systems cause computational overhead and consume the limited resources of sensor nodes. Since sensor nodes are limited in resources (memory, microprocessor, battery, etc.), designing a real-time IDS for WSNs should be considered. In this article, an optimized collaborative intrusion detection system (OCIDS) is proposed for WSNs. It uses an improved artificial bee colony optimization algorithm to optimize the hierarchical IDS applied to WSNs with respect to both the accuracy of intrusion detection and also the consumption of limited resources. Besides that, the proposed system optimizes the weighted support vector machine algorithm to improve the detection accuracy and reduce false alarm rate. Since in hierarchical WSNs each of sensor nodes, cluster heads, and BS has different views of the network, collaboration among them is considered in the proposed OCIDS system to provide more precise intrusion detection. To prove the efficiency and robustness of the proposed system, we analyzed and evaluated the impact of different attack scenarios on the system performance and compared its performance to other systems. Comparing its performance to others in the presence of both normal and intrusion traffic using NSL-KDD dataset proves that it exhibits the highest detection rate and lowest false alarm rate. The proposed system outperforms the other systems by achieving 97.9% average detection rate with a small standard deviation 0.9%, and the average false alarm rate reaches 1.8% with a small standard deviation 1% which shows an obvious advantage than other detection systems.

SvBLOCK: mitigating black hole attack in low-power and lossy networks

The black hole is one of the well-known attacks that occur in Low power and Lossy Networks (LLNs). This paper presents a novel svBLOCK scheme to handle the black hole problem. svBLOCK is based on SVELTE, a real-time intrusion detection system (IDS) for the Internet of Things to reconstruct the destination oriented directed acyclic graph (DODAG) and validate the node availability. It is also equipped with mechanisms to provide authenticity over its control messages and isolate black holes from the LLNs. svBLOCK is implemented in Contiki OS and is evaluated under various attack scenarios. It demonstrates to achieve 98.5% true positive rate (TPR) at a false negative rate of 3.7%, while improving the packet delivery rate (PDR) by up to 47% with respect to the original SVELTE.

A Novel Research on Real-Time Intrusion Detection Technology Based on Data Mining

With the wide application of network technology and the continuous development of network economy, network security issues are also increasingly prominent, it gives the network itself and the information system based on network has brought great threat. Adaptive detection based on data mining is the development trend of intrusion detection system, it can adapt to different network environment, and does not depend on expert training data. Based on the reference on the basis of predecessors, this paper proposes a real-time intrusion detection system based on data mining framework structure. Research based on data mining technology, with adaptability and real-time detection function and the structure of the distributed intrusion detection system, to promote the network information security technology and products to develop in the direction of the omni-directional three-dimensional testing and national information safety inspection work is meaningful.

A Real-Time Intrusion Detection System for Wormhole Attack in the RPL based Internet of Things

Abstract Today there is a trend of the Internet of Things (IoT) where many objects are connected to the internet. In future number of objects connected to the internet will be more as compared to people in the world. So providing security to IoT devices is one of the ongoing research issues. Inserting security in IoT devices is challenging because maximum devices involved in IoT are resource constrained in terms of battery power and memory size. In IoT, nodes communicate using insecure internet which makes network exposed to various attacks. RPL (Routing protocol for low power and lossy network) is the protocol specially designed for IoT network is very prone to various security attacks. The proposed work in this paper is an implementation of an intrusion detection system (IDS) for Wormhole attack and attacker. Wormhole attack is one of the most severe attacks taking place at 6LoWPAN adaption layer of RPL network. In this type of attack, a pair of attacker nodes forms a tunnel between two nodes as if they are directly connected to each other to misguide network traffic. The proposed IDS is implemented in Contiki OS, using Cooja Simulator. We have used received signal strength indicator (RSSI) to identify the attack and attacker node.

A novel honeypot based security approach for real-time intrusion detection and prevention systems

In the digitalized modern world in parallel to the new technological developments, information security has become the highest priority in the individual and institutional sense. In order to ensure the security of information systems, various systems are used techniques and technologies, including encryption, authorization, firewall, honeypot based systems. In this study, a honeypot based approach for intrusion detection/prevention systems (ID/PS) is proposed. The developed honeypot server application is combined with IDSs to analyze data in real-time and to operate effectively. Moreover, by associating the advantages of low and high-interaction honeypots, a superior hybrid honeypot system is performed. Therefore, in order to reduce the cost of configuration, maintenance, and management, after viewing the usage of honeypots on corporate networks, virtualization technologies are used. The developed system is a honeypot based intrusion detection and prevention system (IDPS) type and it is able to show the network traffic on servers visually in real-time animation. Thereby, it provides system information easily. Finally, the developed system can detect zero-day attack due to the configuration of intrusion detection, which makes it superior in performance compared to other IDSs. This system also helps in reducing the false positive level in IDSs.

An intelligent intrusion detection system for secure wireless communication using IPSO and negative selection classifier

Internet security is very crucial need in this real world environment due to the rise of e-business, e-learning, and e-governance. Intellectual data mining applications are useful for producing security while accessing through the internet from cloud databases. Currently, the cloud security researchers are not in a position to introduce more reliable, secure and effective real-time intrusion detection systems for detecting the intruders in online. For fulfilling this requirement, we propose a new intelligent classification model for anomaly detection which detects the intruders effectively in cloud networks using a combination of an enhanced incremental particle swarm optimization and negative selection algorithm. Moreover, we enhanced these two methods by the uses of Minkowski distance metric for effective decision making. The experimental results of the proposed classification model show that this system detects anomalies with low false alarm rate and high detection rate when tested with NSL-KDD dataset which is modified from KDD 1999 Cup dataset.