Secure Intrusion Detection System Research Articles

Computer network big data detection based on internet of things technology

In order to solve the problems of traditional network security intrusion detection system in detection accuracy and missed detection rate, this paper proposes a computer network data detection based on Internet of things technology. This paper designs an intrusion detection system based on data clustering analysis algorithm. The hardware part of the intrusion detection system is composed of six parts: detection module, adaptive module, control management module, risk early warning module, control access module and data acquisition module. Each module is closely connected and updated with the rule base and database in real time; In the software flow design of the system, based on the data clustering analysis algorithm, the collected original data are classified and processed, and the Mings distance is determined, revealing the difference between normal data and abnormal data, and finally realizing the accurate detection of cloud computing network intrusion behavior. The experimental results show that the proposed intrusion detection system has a higher detection accuracy for malicious data, and the average missed detection rate can be controlled below 0.3 %. Conclusionthe detection system designed in this paper has more advantages in stability performance.

Secure intrusion detection system for IOT sensor data using LR-ECC and FY-SFL-DLNN algorithm

Identification and prevention of intrusions is the primary challenge in high-speed networks like IoT. Many Intrusion Detection Systems (IDSs) have been developed already by researchers; but, they are not fully capable of protecting the network. Conventional methods do not optimise their learning models and ignore feature reduction. This negatively impacts the accuracy, efficiency, computation time, and security of the conventional IDS. Hence, this paper proposed a Secure IDS by utilising LR-ECC and FY-SFL-DLNN. Initially, the input dataset is preprocessed and the features are extracted from the data. Utilising the EK-LDA, the features are decreased. After that, utilising the BM-KMA, the data separation occurs. Lastly, by employing FY-SFL-DLNN, data classification is performed. Thus, the IoT sensor data is safely transmitted by utilising the LR-ECC algorithm after detection. Grounded on the experimental outcomes, the proposed work’s performance is analogised with the conventional techniques for validating the proposed system’s effectiveness.

DTL-IDS: An optimized Intrusion Detection Framework using Deep Transfer Learning and Genetic Algorithm

In the dynamic field of the Industrial Internet of Things (IIoT), the networks are increasingly vulnerable to a diverse range of cyberattacks. This vulnerability necessitates the development of advanced intrusion detection systems (IDSs). Addressing this need, our research contributes to the existing cybersecurity literature by introducing an optimized Intrusion Detection System based on Deep Transfer Learning (DTL), specifically tailored for heterogeneous IIoT networks. Our framework employs a tri-layer architectural approach that synergistically integrates Convolutional Neural Networks (CNNs), Genetic Algorithms (GA), and bootstrap aggregation ensemble techniques. The methodology is executed in three critical stages: First, we convert a state-of-the-art cybersecurity dataset, Edge_IIoTset, into image data, thereby facilitating CNN-based analytics. Second, GA is utilized to fine-tune the hyperparameters of each base learning model, enhancing the model’s adaptability and performance. Finally, the outputs of the top-performing models are amalgamated using ensemble techniques, bolstering the robustness of the IDS. Through rigorous evaluation protocols, our framework demonstrated exceptional performance, reliably achieving a 100% attack detection accuracy rate. This result establishes our framework as highly effective against 14 distinct types of cyberattacks. The findings bear significant implications for the ongoing development of secure, efficient, and adaptive IDS solutions in the complex landscape of IIoT networks.

An Intelligent Machine Learning based Intrusion Detection System (IDS) for Smart cities networks

INTRODUCTION: Internet of Things (IoT) along with Cloud based systems are opening a new domain of development. They have several applications from smart homes, Smart farming, Smart cities, smart grid etc. Due to IoT sensors operating in such close proximity to humans and critical infrastructure, there arises privacy and security issues. Securing an IoT network is very essential and is a hot research topic. Different types of Intrusion Detection Systems (IDS) have been developed to detect and prevent an unauthorized intrusion into the network.OBJECTIVES: The paper presents a Machine Learning based light, fast and reliable Intrusion Detection System (IDS).METHODS: Multiple Supervised machine learning algorithms are applied and their results are compared. Algorithms applied include Linear Discriminant analysis, Quadratic Discriminant Analysis, XG Boost, KNN and Decision Tree.RESULTS: Simulation results showed that KNN Algorithm gives us the highest accuracy, followed by XG Boost and Decision Tree which are not far behind.CONCLUSION: A fast, secure and intelligent IDS is developed using machine learning algorithms. The resulting IDS can be used in various types of networks especially in IoT based networks.

Anomaly detection using ensemble techniques for boosting the security of intrusion detection system

IoT-based applications have witnessed a rapid surge in deployment in various domains. IoT infrastructure is the nervous system responsible for the effective functioning of Smart Cities. Nevertheless, the full-fledged deployment of IoT-based applications exposes this infrastructure to a high risk of cyberattacks. Since IoT devices establish communication with cloud services via inbuilt sensors, the probability of sabotaging the communication channel by malicious attacks is always high. This paper aims to explore an anomaly detection method that makes use of techniques like Support Vector Machine (SVM), Artificial Neural Networks (ANN), k- Nearest Neighbor (KNN), Linear Regression (LR), Decision Trees (DT), and Random Forest (RF) to neutralize threats and boost the cybersecurity of a smart city. The paper goes on to examine the role of ensemble techniques like bagging and boosting to provide an additional security layer to the detection architecture. This is where the paper departs from the erstwhile approaches that have revolved around single classifiers to boost the detection system and have not considered the integration of cross-validation and feature selection. The experimental results conducted on the datasets UNSW-BC15 and CICIDS2017 and several measures like Accuracy, Precision, Recall, and F1 Score establish that the proposed approach outperforms various state-of-the-art methods used in detecting rare attacks.

A Collaborative Approach for Secured Routing in Mobile Ad-Hoc Network

Mobile computing is the most powerful application for network communication and connectivity, given recent breakthroughs in the field of wireless networks or Mobile Ad-hoc networks (MANETs). There are several obstacles that effective networks confront and the networks must be able to transport data from one system to another with adequate precision. For most applications, a framework must ensure that the retrieved data reflects the transmitted data. Before driving to other nodes, if the frame between the two nodes is deformed in the data-link layer, it must be repaired. Most link-layer protocols immediately disregard the frame and enable the high-layer protocols to transmit it down. In other words, because of asset information must be secured from threats, information is a valuable resource. In MANETs, some applications necessitate the use of a network method for detecting and blocking these assaults. Building a secure intrusion detection system in the network, which provides security to the nodes and route paths in the network, is a major difficulty in MANET. Attacks on the network can jeopardize security issues discovered by the intrusion detection system engine, which are then blocked by the network’s intrusion prevention engine. By bringing the Secure Intrusion Detection System (S-IDS) into the network, a new technique for implementing security goals and preventing attacks will be developed. The Secure Energy Routing (SER) protocol for MANETs is introduced in this study. The protocol addresses the issue of network security by detecting and preventing attacks in the network. The data transmission in the MANET is forwarded using Elliptical Curve Cryptography (ECC) with an objective to improve the level of security. Network Simulator – 2 is used to simulate the network and experiments are compared with existing methods.

Association Rule Mining Frequent-Pattern-Based Intrusion Detection in Network

In the network security system, intrusion detection plays a significant role. The network security system detects the malicious actions in the network and also conforms the availability, integrity and confidentiality of data information resources. Intrusion identification system can easily detect the false positive alerts. If large number of false positive alerts are created then it makes intrusion detection system as difficult to differentiate the false positive alerts from genuine attacks. Many research works have been done. The issues in the existing algorithms are more memory space and need more time to execute the transactions of records. This paper proposes a novel framework of network security Intrusion Detection System (IDS) using Modified Frequent Pattern (MFP-Tree) via K-means algorithm. The accuracy rate of Modified Frequent Pattern Tree (MFPT)-K means method in finding the various attacks are Normal 94.89%, for DoS based attack 98.34%, for User to Root (U2R) attacks got 96.73%, Remote to Local (R2L) got 95.89% and Probe attack got 92.67% and is optimal when it is compared with other existing algorithms of K-Means and APRIORI.

Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID

Technological breakthroughs in the Internet of Things (IoT) easily promote smart lives for humans by connecting everything through the Internet. The de facto standardised IoT routing strategy is the routing protocol for low-power and lossy networks (RPL), which is applied in various heterogeneous IoT applications. Hence, the increase in reliance on the IoT requires focus on the security of the RPL protocol. The top defence layer is an intrusion detection system (IDS), and the heterogeneous characteristics of the IoT and variety of novel intrusions make the design of the RPL IDS significantly complex. Most existing IDS solutions are unified models and cannot detect novel RPL intrusions. Therefore, the RPL requires a customised global attack knowledge-based IDS model to identify both existing and novel intrusions in order to enhance its security. Federated transfer learning (FTL) is a trending topic that paves the way to designing a customised RPL-IoT IDS security model in a heterogeneous IoT environment. In this paper, we propose a federated-transfer-learning-assisted customised distributed IDS (FT-CID) model to detect RPL intrusion in a heterogeneous IoT. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection. Initially, the central server initialises the FT-CID with a predefined learning model and observes the unique features of different RPL-IoTs to construct a local model. The experimental model generates an RPL-IIoT dataset with normal and abnormal traffic through simulation on the Contiki-NG OS. Secondly, the edge IDSs are trained using the local parameters and the globally shared parameters generated by the central server through federation and aggregation of different local parameters of various edges. Hence, transfer learning is exploited to update the server's and edges' local and global parameters based on relational knowledge. It also builds and customised IDS model with partial retraining through local learning based on globally shared server knowledge. Finally, the customised IDS in the FT-CID model enforces the detection of intrusions in heterogeneous IoT networks. Moreover, the FT-CID model accomplishes high RPL security by implicitly utilising the local and global parameters of different IoTs with the assistance of FTL. The FT-CID detects RPL intrusions with an accuracy of 85.52% in tests on a heterogeneous IoT network.

Scalable Collaborative Intrusion Detection in Autonomous Vehicular Networks: A hierarchical framework based on game theory

Autonomous Vehicles (AVs) networks are vulnerable to security attacks targeting data integrity and service availability. To successfully operate in emerging automated highway systems (AHS), securing communications among the AVs and with the transportation infrastructure is paramount. An Intrusion Detection System (IDS) is the foremost defense artifact against malicious AV activities. However, individual IDS on board of the AV may not be sufficient enough against diverse and increasingly emerging new threats. In addition, not all security vendors synchronize their update of new IDS security features. Therefore, the collaboration among individual IDSs of AVs enables the vehicles to benefit from the collective knowledge and information of their neighbors and achieve more accurate intrusion detection. This paper presents a hierarchical framework for a Collaborative Intrusion Detection Network (CIDN) that allows the AV platoons to share detection knowledge based on trust and increase the accuracy of their individual IDS. The proposed CIDN involves intra-platoon and inter-platoon collaborations to improve scalability. The experimental results show that collaborative IDSs yield higher accuracy than individual IDSs in detecting misbehaviors in AV networks while achieving scalability.

XGBoost for Imbalanced Multiclass Classification-Based Industrial Internet of Things Intrusion Detection Systems

The Industrial Internet of Things (IIoT) has advanced digital technology and the fastest interconnection, which creates opportunities to substantially grow industrial businesses today. Although IIoT provides promising opportunities for growth, the massive sensor IoT data collected are easily attacked by cyber criminals. Hence, IIoT requires different high security levels to protect the network. An Intrusion Detection System (IDS) is one of the crucial security solutions, which aims to detect the network’s abnormal behavior and monitor safe network traffic to avoid attacks. In particular, the effectiveness of the Machine Learning (ML)-based IDS approach to building a secure IDS application is attracting the security research community in both the general cyber network and the specific IIoT network. However, most available IIoT datasets contain multiclass output data with imbalanced distributions. This is the main reason for the reduction in the detection accuracy of attacks of the ML-based IDS model. This research proposes an IDS for IIoT imbalanced datasets by applying the eXtremely Gradient Boosting (XGBoost) model to overcome this issue. Two modern IIoT imbalanced datasets were used to assess our proposed method’s effectiveness and robustness, X-IIoTDS and TON_IoT. The XGBoost model achieved excellent attack detection with F1 scores of 99.9% and 99.87% on the two datasets. This result demonstrated that the proposed approach improved the detection attack performance in imbalanced multiclass IIoT datasets and was superior to existing IDS frameworks.

Secure intrusion detection system routing protocol for mobile ad‐hoc network

With the recent advancements in the field of wireless networks or Mobile Ad-hoc networks (MANETs), mobile computing is the most powerful use for network communication and connectivity. Effective networks come across with numerous difficulties. Networks need to be able to transmit data with acceptable precision from one system to another. A framework must ensure that the retrieved data is consistent with the transmitted data for most applications. If the frame between the two nodes is distorted in the data-link layer, it must be corrected before having driven to other nodes. However, most protocols with the link-layer simply dismiss the frame and allow the high-layer protocols to pass down the frame. In other words, information is a valuable commodity, since asset information must be protected from threats. Some applications require a network mechanism for detecting and preventing these attacks in MANETs. An important challenge in MANET is building the secure intrusion detection system in network providing security to the nodes and route paths in network. The attacks in network can threaten the security issues which have been identified in the intrusion detection system engine, later it is prevented by intrusion prevention engine in the network. A henceforth new technique to implement the security goals and prevent attacks is implemented by introducing the Secure-Intrusion Detection System (S-IDS) in the network. The research work introduced the Secure Energy Routing (SER) protocol for the MANETs. The protocol solves the issue of security in network by detecting the attacks and preventing them in the network. The simulation results show the higher packet delivery ratio and low end-to-end delay with and without attacks. The protocol performance is good in terms of its packet delivery ratio and low end-to-end delay respectively.

Two Phase - Intrusion Detection System (TP-IDS) model using Machine Learning Techniques

Network security is one of the important issues that should be handled carefully and security to our data and important information is necessary when communicating with outside world over the internet. We have so many examples of the attacks that have been happened in the past and threatened a huge loss to the world. Over the years, a lot of work is done in this area and many security systems are developed, many security algorithms are implemented which have strong security fundamentals. Also, these systems have proven strong at the time of highly insecurity incidences or attacks. But, the problem is still there in identifying the malicious node entry in the network correctly without any false positives or false negatives, also within quick time before getting any type of access to the network by such malicious nodes which are also called as intruders. We need a system which should be operating faster even in heavy incoming network traffic scenarios, and generating correct identification of the intruders as well as giving easy, faster network access to non intruders or normal connecting nodes by correctly identifying them as normal nodes. In this research work, we are carrying out the implementation of the Intrusion detection System (IDS) model which performs faster as well as classifies the communicating nodes correctly as intruder or normal user. This IDS model is being implemented in two phases, hence a Two Phase Intrusion Detection System, abbreviated and named as TP-IDS model. We are using the machine learning techniques to develop this model, which makes this model a strongly secure IDS model and helping to better identify the known as well as unkown attack. We are using first phase for the identification and second phase for the validation of the first phase results of our model, which provides high accuracy. In first phase of the IDS we are using Support Vector Machine (SVM), k Nearest Neighbor (kNN) and in second phase we are using Decision Tree (DT), Naive Bayes (NB) for first phase validation. Also, the issue of efficiency is handled by underlying data processing infrastructure, which is HADOOP that increases efficiency or speed of the TP-IDS.

Deep Learning based Optimization algorithm for Cyber Security Intrusion Detection System

Deep Learning based Optimization algorithm for Cyber Security Intrusion Detection System

Intrusion detection system using deep learning methodologies

Intrusion Detection Systems (IDS) are the backbone that helps secure organizations and individuals from malicious internet traffic. Deep-Learning is another field of computer science that enables us to build productive Artificial Intelligence (AI) models that can be applied in a variety of fields. In this paper, we discuss the CSE-CIC-IDS2018 dataset for internet intrusion detection and provide a detailed study and analysis of various deep learning approaches that could be used to make a secure intrusion detection system. We test the accuracy of these algorithms and their effectiveness in detecting the malicious traffic for multiclass classification of the traffic in 14 different classes including benign traffic and malicious traffic. The outcome of which is to obtain a model framework based upon deep learning to build a usable model for an intelligent IDS that could potentially be used for real time data traffic security.

Research on Attributes Reduction Method of Intrusion Detection Data Based on Rough Set Theory

With the huge amount of network connection data, high data dimensions and complex attack types, it is difficult for traditional data analysis techniques to obtain satisfactory results in the Network Security Intrusion Detection System. This paper proposed a RSDB method based on the Rough Set Theory and the Data Deblock Thought, which can help us to reduce the data conditional attributes and remix the data. The method considers two factors: the relationship between conditional attributes and decision attribute, and the data integrity. Through the experiment, this method can solve these difficult above problems effetely, while ensuring the original data is not distorted. Through many experiments and their experimental results, RSDB can not only make the classification accuracy over than 90%, but also its average detection time is in the millisecond level.

Energy Efficient Cluster based Routing Protocol with Secure IDS for IoT Assisted Heterogeneous WSN

Currently, wireless sensor networks (WSNs) and the Internet of Things (IoT) have become useful in a wide range of applications. The nodes in IoT assisted WSN commonly operate on restricted battery units, meaning energy efficiency is a major design issue. Clustering and route selection processes are commonly utilized energy-efficient techniques for WSN. Although several cluster-based routing approaches are available for homogeneous WSN, only a limited number of studies have focused on energy efficient heterogeneous WSN (HWSN). Moreover, security poses a major design issue in the HWSN. This paper introduces an energy efficient cluster-based routing protocol with a secure intrusion detection system in HWSN called EECRP-SID. The proposed EECRP-SID technique involves three main phases: cluster construction, optimal path selection, and intrusion detection. Initially, the type II fuzzy logic-based clustering (T2FC) technique with three input parameters are applied for cluster head (CH) selection. These parameters are residual energy level (REL), distance to the base station (DTBS), and node density (NDEN). In addition to CH selection, the salp swarm optimization (SSO) technique is utilized to select optimal paths for inter cluster data transmission, which results in energy efficient HWSN. Finally, to achieve security in cluster based WSN, an effective intrusion detection system (IDS) using long short-term memory (LSTM) is executed on the CHs to identify the presence of intruders in the network. The EECRP-SID method was implemented in MATLAB, and experimental outcomes indicate that it outperformed the compared methods in terms of distinct performance measures.

Certain Investigation on MANET Security with Routing and Blackhole Attacks Detection

Abstract Mobile Ad-hoc Network (MANET) is a self-configuring network depending upon infrastructure, also is a significant technology which supplies virtual hardware and software resources as per requirement of mobile ad hoc network. The Intrusion Detection System (IDS) has been established to protect Cross Interior (routing) at source to goal from different types of attack. Current IDS approaches can be classified as either anomaly or signature-based methods such as Rule-based expert systems, State transition analysis, Bayesian alarm networks aspects are various challenges with respect to the efficiency as well as performance. The major challenge is the compromise of performance because of unavailable resources with respect to the MANET. To increase the MANET environment’s performance, various techniques are employed for routing, security purpose. An efficient security module requires a routing in terms of packet loss. The Integrated Cross Interior (ICI) structure for Intrusion Detection System (IDS) namely ICIs for IDS are proposed for exactness of black hole attacks detection. The ICIs for IDS performs the task of routing of the mobile nodes. The proposed (ICIs for IDS) produces the enhancement of Intrusion Detection System (IDS) with routing algorithm named as Integrated Cross Interior algorithm that performs maps the security with the secure IDS communication and distributes the packets among different destination, based on priority. This paper proposes a novel Integrated Cross Interior structure for Intrusion Detection System (ICIS for IDS) to secure our network from black hole attacks. This algorithm is proposed for node routing and node security by considering maximum throughput 83.5% with minimum routing cost, response time with 6.3ms. The experimental results specify that ICIs for IDS based security policy effectively minimizes the response time as well as the mobile routing cost, response time of an application with respect to other existing approaches such as IDS with AODV. The proposed algorithm is experimented using Network Simulator-2 and the results demonstrated that the performance of the algorithm is better than other conventional algorithms like IDS with AODV.

Fuzzy Based Secure Intrusion Detection System for Authentication in Wireless Sensor Networks

Fuzzy Based Secure Intrusion Detection System for Authentication in Wireless Sensor Networks

A Model of a Pragmatic Secure Intrusion Detection System for Local Area Networks

Intrusion detection is very imperative in network systems due to outstanding vulnerabilities left unaddressed by current preventive network security measures such as firewalls and encryption software. The inefficiency, inaccuracy, high false alarm rates and lack of self-defensive mechanism of existing network security systems has continued to pose serious conc ern to network users, administrators and security professionals and thus needs urgent redress. There fore, the target of this paper is to develop a model of a pragmatic secure intrusion detection system for l ocal area networks using layered framework with conditional random fields that is capable of overcoming the apparent shortcomings of present intrusion detection systems. A critical analysis of existi ng IDSs was done using the structured system analysis and design methodology (SSADM) due to the sequential configuration of the proposed security system. Furthermore, a real-time response mechanism and a self-defensive mechanism for a network intrusion detection system (NIDS) was developed and implemented. The outcome of this study was a secured IDS that would proactively address potential security vulnerabilities by resisting and detecting attacks and security policy violations reliably and effic iently in local area networks, thus making it inevitable for use in our security conscious environment of the 21 st century.

A Framework for Fast and Efficient Cyber Security Network Intrusion Detection Using Apache Spark

Due to increase in internet based services, the size of network traffic data has become so large and complex that it is very difficult to process with the traditional data processing tools. Fast and efficient cyber security intrusion detection is a very challenging problem due to big and complex nature of network traffic data. A realistic cyber security intrusion detection system should be able to process large size of network traffic data as fast as possible in order to detect the malicious traffic as early as possible. This paper used Apache Spark, a big data processing tool for processing the large size of network traffic data. In this paper, we have proposed a framework in which first a well-known feature selection algorithm is employed for selecting the most important features and then classification based intrusion detection method is used for fast and efficient detection of intrusion in the massive network traffic. In this work, we have used two well-known feature selection algorithm, namely, correlation based feature selection and Chi-squared feature selection and five well known classification based intrusion detection methods, namely, Logistic regression, Support vector machines, Random forest, Gradient Boosted Decision trees & Naive Bayes. A real time DARPA's KDD’99 data set is used to validate the proposed framework and performance comparison of classification based intrusion detection schemes are evaluated in terms of training time, prediction time, accuracy, sensitivity and specificity.