Signature-based Intrusion Detection Systems Research Articles

Leveraging Advanced Machine Learning Algorithms for Enhanced Cyberattack Detection on U.S. Business Networks

Cyberattacks' rising volume and sophistication have made conventional security measures, such as firewalls, signature-based intrusion detection systems, and antivirus software, increasingly inadequate. The upsurge of cyber threats has been one of the most pressing predicaments for U.S. organizations in the digital age. With the increased dependence on internet-based forums, cloud computing, and interconnected networks, companies face an advancing number of extreme cyberattacks. The chief objective of this research project is to design and deploy proven machine learning methods to enhance the detection and combating of cyberattacks on U.S. organization networks. This research project retrieved a cyber-attack dataset from Kaggle.com, which had a collection of public datasets of cyber threats. This dataset was curated precisely, offering a realistic representation of cyber-attack scenarios, making it an ideal playground for various analytical tasks. The collection was classified as per the source of the relevant information, such as host-based datasets, network traffic datasets, malware or fraud reports, or a special section for datasets that can be classified according to a specific source. The dataset comprised numerous network traffic attributes such as source and destination IP addresses, ports, protocol, payload size, and attack labels. For this research project, three machine learning algorithms were used, namely: Logistic Regression, XG-Boost and Random Forest. This research project applied performance metrics such as accuracy, precision, recall, and F1 score for the performance of the classification models were considered. The result illustrated that the random forest model was far superior in accuracy compared to the logistic regression model; particularly, it had excellent accuracy. Through the use of advanced machine learning models, organizations will be in a position to devise more dynamic and intelligent security systems that evolve with the threat landscape. These intelligent systems monitor every kind of anomaly, malicious activity, and threat response with unparalleled effectiveness. The findings of this research project have significant implications for enhancing cybersecurity in U.S. organizational networks.

Artificial Intelligence Based Multi-Layer Approach for Finding Unknown Attacks in Cloud Network by Using Hybrid Intrusion Detection

Objectives : The objective of this study is to explore Intrusion Detection Systems and their various types by gathering research from previously published articles in refereed journals. The focus is on developing a proposed model capable of identifying unknown attacks in cloud networks using Signature and Anomaly-based Intrusion Detection Systems. Subsequently, the efficiency of the proposed model will be assessed, and a comparison with existing models will be conducted. The paper's main objective is to identify unknown attacks in a cloud network using a combination of signature and anomaly-based intrusion detection systems in an artificial intelligence-based multi-layered approach. Methods: Leveraging insights from existing literature, the proposed model combines signature-based IDS for known threat detection and anomaly-based IDS for detecting unusual behavioral patterns indicative of new or unseen attacks. Experimental evaluations using NSL-KDD and ADFA datasets demonstrate competitive accuracy and detection rates, with the proposed artificial intelligence-based Hybrid IDS achieving high performance in detecting both normal and malicious activities. Findings: This model produces above 90%, 96%, and 98% efficiency in the wired, Wireless, and Cloud networks respectively, and this model finds known attacks effectively while using parameters like event logs, file transferring time, TCP and UDP addresses, CPU Usage, Weak and synthetic data, IP and MAC address. Existing literature said that the existing model using the Hybrid Intrusion detection model can identify unknown attacks with a maximum of 80%, 92%, and 96% accuracy respectively. The findings suggest that the artificial intelligence-based multi-layered approach offers a promising solution for enhancing cloud network security, with the potential for further optimization and integration of advanced technologies in future research endeavors. Novelty: This study presents an artificial intelligence-based multi-layered approach for detecting unknown attacks in cloud networks by integrating signature-based and anomaly-based intrusion detection systems (IDS). The authors developed the model to detect the intrusion by using the Behaviour Profiling algorithm and dynamically prevent the data from intrusion by using the Statistical approach model. The authors trying to find unknown attacks, therefore the authors defined the objective of this paper as to find the unknown attacks in cloud networks by using the combination of signature and anomaly-based intrusion detection systems. The objective is to develop a model capable of effectively identifying cyber threats in cloud environments. The existing models do not concentrate on identifying unknown attacks by using Signature-based Intrusion Detection. Very few of the literature said that known attacks can be identified easily by using Signature-based Intrusion Detection but the unknown attacks identifying process is hard. Some of the Literature said that using the Hybrid Intrusion detection model can identify unknown attacks with a maximum of 80%, 92%, and 96% accuracy respectively. The current paper identifies unknown attacks in the cloud network using a combination of signature and anomaly-based intrusion detection systems in an artificial intelligence-based multi-layered approach and it produced above 97% accuracy. The unique feature of the model is artificial intelligence-based multi-layered approach and dynamic key have been utilized to avoid malicious activities in the network. Keywords: Anomaly based IDS, Cloud Network Security, Hybrid IDS, Multi-Layer Approach, Signature based IDS

Enhancing trustworthiness in ML-based network intrusion detection with uncertainty quantification

A crucial role in the security of modern networks is played by Intrusion Detection Systems (IDSs), security devices designed to identify and mitigate attacks to networks structure. Data-driven approaches based on Machine Learning (ML) have gained more and more popularity for executing the classification tasks required by signature-based IDSs. However, typical ML models adopted for this purpose do not properly take into account the uncertainty associated with their prediction. This poses significant challenges, as they tend to produce misleadingly high classification scores for both misclassified inputs and inputs belonging to unknown classes (e.g. novel attacks), limiting the trustworthiness of existing ML-based solutions. In this paper, we argue that ML-based IDSs should always provide accurate uncertainty quantification to avoid overconfident predictions. In fact, an uncertainty-aware classification would be beneficial to enhance closed-set classification performance, would make it possible to carry out Active Learning, and would help recognize inputs of unknown classes as truly unknowns, unlocking open-set classification capabilities and Out-of-Distribution (OoD) detection. To verify it, we compare various ML-based methods for uncertainty quantification and open-set classification, either specifically designed for or tailored to the domain of network intrusion detection. Moreover, we develop a custom model based on Bayesian Neural Networks that stands out for its OoD detection capabilities and robustness, with a lower variance in the results over different scenarios, compared to other baselines, thus showing how proper uncertainty quantification can be exploited to significantly enhance the trustworthiness of ML-based IDSs.

A distributed and cooperative signature-based intrusion detection system framework for multi-channel man-in-the-middle attacks against protected Wi-Fi networks

A Multi-Channel Man-in-the-Middle (MC-MitM) attack is an advanced form of MitM attack, characterized by its ability to manipulate encrypted wireless communications between the Access Point (AP) and clients within a WiFi network. MC-MitM attacks can target any Wi-Fi client, regardless of the authentication method used with the AP. Notable examples of such attacks include Key Reinstallation Attacks and FragAttacks, which have impacted millions of WiFi systems worldwide, especially those involving Internet of Things devices. Current defense mechanisms are inadequate against these attacks due to interoperability challenges and the need for modifications to devices or protocols within the targeted Wi-Fi networks. This paper introduces a distributed and cooperative signature-based wireless intrusion detection mechanism designed for online passive monitoring to detect malicious traffic patterns during MC-MitM attacks in any environment, from apartments and houses to large areas like hotels, offices or industrial sites. We implemented the proposed framework on Raspberry Pis and evaluated it in real-world settings. Our evaluation demonstrates that this framework can effectively identify MC-MitM attacks with an average accuracy of 98% when deployed across different locations within our experimental testbed.

Feature-Selection-Based DDoS Attack Detection Using AI Algorithms

SDN has the ability to transform network design by providing increased versatility and effective regulation. Its programmable centralized controller gives network administration employees more authority, allowing for more seamless supervision. However, centralization makes it vulnerable to a variety of attack vectors, with distributed denial of service (DDoS) attacks posing a serious concern. Feature selection-based Machine Learning (ML) techniques are more effective than traditional signature-based Intrusion Detection Systems (IDS) at identifying new threats in the context of defending against distributed denial of service (DDoS) attacks. In this study, NGBoost is compared with four additional machine learning (ML) algorithms: convolutional neural network (CNN), Stochastic Gradient Descent (SGD), Decision Tree, and Random Forest, in order to assess the effectiveness of DDoS detection on the CICDDoS2019 dataset. It focuses on important measures such as F1 score, recall, accuracy, and precision. We have examined NeTBIOS, a layer-7 attack, and SYN, a layer-4 attack, in our paper. Our investigation shows that Natural Gradient Boosting and Convolutional Neural Networks, in particular, show promise with tabular data categorization. In conclusion, we go through specific study results on protecting against attacks using DDoS. These experimental findings offer a framework for making decisions.

Self-healing hybrid intrusion detection system: an ensemble machine learning approach

The increasing complexity and adversity of cyber-attacks have prompted discussions in the cyber scenario for a prognosticate approach, rather than a reactionary one. In this paper, a signature-based intrusion detection system has been built based on C5 classifiers, to classify packets into normal and attack categories. Next, an anomaly-based intrusion detection was built based on the LSTM (Long-Short Term Memory) algorithm to detect anomalies. These anomalies are then fed into the signature generator to extract attributes. These attributes get uploaded into the C5 training set, aiding the ensemble model in continual learning with expanding signatures of unknown attacks. By generating signatures of unknown attacks, the self-healing attribute of the ensemble model contributes to the early detection of attacks. For the C5 classifier, the proposed model is evaluated on the UNSW-NB15 dataset, while for the LSTM model, it is evaluated on the ADFA-LD dataset. Compared to conventional models, the experimental results show better detection rates for both known and unknown attacks. The C5 classifier achieved a True Positive Rate of 97% while maintaining a false positive rate of 8%. Also, the LSTM model achieved a detection rate of 90% while retaining a 17% False Alarm Rate. As the proposed model learns, its performance in real network traffic also improves and it also eliminates human intervention when updating training data.

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

Over the last few years, a plethora of papers presenting machine-learning-based approaches for intrusion detection have been published. However, the majority of those papers do not compare their results with a proper baseline of a signature-based intrusion detection system, thus violating good machine learning practices. In order to evaluate the pros and cons of the machine-learning-based approach, we replicated a research study that uses a deep neural network model for intrusion detection. The results of our replicated research study expose several systematic problems with the used datasets and evaluation methods. In our experiments, a signature-based intrusion detection system with a minimal setup was able to outperform the tested model even under small traffic changes. Testing the replicated neural network on a new dataset recorded in the same environment with the same attacks using the same tools showed that the accuracy of the neural network dropped to 54%. Furthermore, the often-claimed advantage of being able to detect zero-day attacks could not be seen in our experiments.

Intrusion Detection System

The use of encrypted data, the diversity of new protocols, and the surge in the number of malicious activities worldwide have posed new challenges for intrusion detection systems (IDS). In this scenario, existing signature-based IDS are not performing well. Various researchers have proposed machine learning-based IDS to detect unknown malicious activities based on behaviour patterns. Results have shown that machine learning-based IDS perform better than signature-based IDS (SIDS) in identifying new malicious activities in the communication network. In this paper, the authors have analyzed the IDS dataset that contains the most current common attacks and evaluated the performance of network intrusion detection systems by adopting two data resampling techniques and 10 machine learning classifiers. It has been observed that the top three IDS models—KNeighbors, XGBoost, and AdaBoost—outperform binary-class classification with 99.49%, 99.14%, and 98.75% accuracy, and XGBoost, KNneighbors, and GaussianNB outperform in multi-class classification with 99.30%, 98.88%, and 96.66% accuracy.

Обзор систем обнаружения вторжений

In the modern digital era, the escalating dependence on interconnected systems raises growing concerns in the field of cybersecurity. This article addresses the pressing need to enhance security measures using Intrusion Detection Systems (IDS), emphasizing their role in the analysis of system logs and data streams to detect and prevent malicious attacks. Intrusion Detection Systems play a crucial role in fortifying networks against potential threats, providing a fundamental level of protection for personal data, applications, and business transactions. The article explores the mechanisms of operation of Intrusion Detection Systems, their classifications, algorithms, as well as their advantages and disadvantages. Structured sequentially, the article commences with an introduction, followed by discussions on the common goals, general structure, signature-based intrusion detection systems, anomaly detection systems, and hybrid intrusion detection systems. The concluding section consolidates the key findings, formulating comprehensive conclusions about the intricate landscape of intrusion detection systems.

A Learning Approach for The Identification of Network Intrusions Based on Ensemble XGBoost Classifier

The limitation of signature-based Intrusion Detection systems has given rise for the popularity of Machine learning (ML) approaches r for building such intrusion detection systems (IDSs). ML is a sub-filed of Artificial Intelligence that enables algorithms to learn from data and its applications have been widely accepted and used in many domains. To achieve a promising ML-based model that can identify attacks and intrusions in networks and the cyber space, different stages of machine learning approach like pre-processing, attribute selection, model building, hyper parameter tuning can be very important. CICIDS2017 intrusion dataset was used for all the experimentations. This study focuses on building cyber threat detection model based on the ensemble feature selection and classification method. Innovative approaches were used for the analysis and pre-processing of the dataset. Thereafter, XGboost algorithm was used for selecting relevant features from the default input attributes in each of the captures. Thereafter, the reduced features were employed in the identification of cyber intrusions. The average accuracy achieved in the 8 captures of the dataset is 98% while precision is 0.98. Also, recall is 0.98, f1-score is 0.98 while AUC ROC score is 0.99. The study concluded that XGBoost-based model was able to achieve promising results based on the proper dataset encoding, feature importance-based feature selection and tuning of the algorithm for intrusion identification.

A perspective–retrospective analysis of diversity in signature-based open-source network intrusion detection systems

The signature-based network intrusion detection systems (IDSs) entail relying on a pre-established signatures and IP addresses that are frequently updated to keep up with the rapidly evolving threat landscape. To effectively evaluate the efficacy of these updates, a comprehensive, long-term assessment of the IDSs’ performance is required. This article presents a perspective–retrospective analysis of the Snort and Suricata IDSs using rules that were collected over a 4-year period. The study examines how these IDSs perform when monitoring malicious traffic using rules from the past, as well as how they behave when monitoring the same traffic using updated rules in the future. To accomplish this, a set of Snort Subscribed and Suricata Emerging Threats rules were collected from 2017 to 2020, and a labeled PCAP data from 2017 to 2018 was analyzed using past and future rules relative to the PCAP date. In addition to exploring the evolution of Snort and Suricata IDSs, the study also analyses the functional diversity that exists between these IDSs. By examining the evolutionary behavior of signature-based IDSs and their diverse configurations, the research provides valuable insights into how their performance can be impacted. These insights can aid security architects in combining and layering IDSs in a defence-in-depth deployment.

Enhancing network security through machine learning: A study on intrusion detection system using supervised algorithms

The topic of Intrusion Detection System (IDS) has become a highly debated issue in cybersecurity, generating intense discussions among experts in the field. IDS can be broadly categorized into two types: signature-based and anomaly-based. Signature-based IDS employ a collection of known network attacks to identify the precise attack the network is experiencing, while anomaly-based IDS employ machine learning models to detect anomalies present in the network traffic that could indicate a potential attack. In this study, we concentrate on anomaly-based IDS, evaluating the effectiveness of three supervised learning algorithms - Decision Tree (DT), Naive Bayes (NB), and K-Nearest Neighbor (KNN) - to determine the most suitable algorithm for each dataset based on its source. We conducted tests to evaluate each algorithm's performance and choose the best one for each dataset. Our findings show that anomaly-based IDS is highly effective in enhancing network security, providing valuable insights for organizations looking to improve their security measures.

A Literary Review of Pattern Matching Techniques in Network Intrusion Detection

With the exponential growth in devices and services being added to networks, we are also witnessing an increase in the volume and complexity of threats, urging an increased efficiency in network intrusion detection systems which primarily rely on pattern matching to identify malicious activity on the network. In this literary review of pattern matching techniques in network intrusion detection, we explore the limitations and the research carried out in both signature-based and anomaly-based intrusion detection systems to overcome them. It focuses on the performance improvements in signature-based intrusion detection systems achieved through methodologies and technologies like regular expressions, Hyperscan, RE2, Flashtext, a generalized Aho-Corasick algorithm, usage of Bloom filters and payload sampling. It also covers the usage of machine learning techniques, including genetic algorithms, Support Vector Machines (SVM) and Improved Self-Adaptive Bayesian Algorithm (ISABA), which are used to detect anomalous behavior and identify potential threats in a network in anomaly-based network intrusion detection to assist the security analysts carry out their job functions. Additionally, this review explores the integration of the MITRE ATT&CK framework and Security Information and Event Management (SIEM) systems in network intrusion detection as this framework provides a structured and standardized approach for analyzing the tactics and techniques used by attackers to classify them, while SIEM systems enable the correlation of threat activity across multiple sources, allowing for a more comprehensive and accurate view of the network security. Overall, this literary review provides insights into the state-of-the-art techniques and frameworks used in Network Intrusion Detection based on Pattern Matching, highlighting the significant improvements in performance and detection capabilities.

Evaluating the impact of generative adversarial models on the performance of anomaly intrusion detection

AbstractWith the increasing rate and types of cyber attacks against information systems and communication infrastructures, many tools are needed to detect and mitigate against such attacks, for example, Intrusion Detection Systems (IDSs). Unfortunately, traditional Signature‐based IDSs (SIDSs) perform poorly against previously unseen adversarial attacks. Anomaly‐based IDSs (AIDSs) use Machine Learning (ML) and Deep Learning (DL) approaches to overcome these limitations. However, AIDS performance can be poor when trained on imbalanced datasets. To address the challenge of AIDS performance caused by these unbalanced training datasets, generative adversarial models are proposed to obtain adversarial attacks from one side and analyse their quality from another. According to extensive usage and reliability criteria for generative adversarial models in different disciplines, Generative Adversarial Networks (GANs), Bidirectional GAN (BiGAN), and Wasserstein GAN (WGAN) are employed to serve AIDS. The authors have extensively assessed their abilities and robustness to deliver high‐quality attacks for AIDS. AIDSs are constructed, trained, and tuned based on these models to measure their impacts. The authors have employed two datasets: NSL‐KDD and CICIDS‐2017 for generalisation purposes, where ML and DL approaches are utilised to implement AIDSs. Their results show that the WGAN model outperformed GANs and BiGAN models in binary and multiclass classifications for both datasets.

ALSNAP: Attention-based long and short-period network security situation prediction

The Internet of Things (IoT) and other emerging communication and network technologies enable improved efficiency, convenience, and connectivity in various domains. However, these advancements also pose significant security risks due to the increasing complexity of attacks and the lack of effective security strategies. Traditional security schemes, such as signature-based intrusion detection systems, have limited predictive power and require a considerable number of cybersecurity staff. Therefore, proactive defense techniques based on network security situation prediction are essential. Network security situation prediction aims to forecast the future state of network security based on historical data and current observations. However, current prediction methods can only capture either long-term or short-term data features, leading to unsatisfactory results. In contrast, this paper proposes a novel attention-based long and short-period network security situation prediction (ALSNAP) scheme that combines improved bidirectional long short-term memory, vector autoregression, and multi-scale convolution with branching attention. It applies an attention mechanism to optimize the prediction model and enhance its accuracy. We evaluated ALSNAP on four public network datasets, including three typical IoT datasets, and compared it with other state-of-the-art methods. Our results demonstrate that ALSNAP achieves higher prediction accuracy than other methods. We also analyzed the potential applications of our scheme to real networks and its integration into intelligent network security situation awareness systems to deliver timely and effective countermeasures.

Dynamic Inertia Weight Particle Swarm Optimization for Anomaly Detection: A Case of Precision Irrigation

Anomaly-based Intrusion Detection System (IDS) is a type of IDS that detects abnormal behaviors by analyzing system activity and network traffic. Anomaly-based IDS works by establishing a baseline of normal behavior for a system or a network. However, these types of systems are less used compared to signature-based IDS for one primary challenge: How to define this normal behavior baseline? The answer to this question is complicated, since it involves not only analyzing or learning from historical data, but requires and understanding of the business domain the system is implemented in. The present study proposes a novel approach to constructing an unsupervised data classifier that combines both Particle Swarm Optimization (PSO) and clustering techniques for anomaly detection. The primary objective of this methodology is to surmount the limitations that conventional clustering algorithms suffer from, such as their inability to identify non-linear patterns within the data, susceptibility to initial conditions, and difficulty in overcoming the problem of local optima. The concept of particle systems is discussed by examining their origins, search strategies, and convergence mechanisms. We use a variant of the Particle Swarm Optimization called Dynamic Inertia Weight-Particle Swarm optimization (DIW-PSO) for our clustering process, and we elaborate on the reasoning behind this decision. Subsequently, we describe the labeling algorithm used for the resulting clusters and we explain the process for identifying anomalous clusters. We have demonstrated the effectiveness of our method by applying it to an intelligent irrigation control system for cotton plants. The results show that our classifier was able to accurately detect abnormal patterns that deviated from the optimal water requirements and growth conditions of the plants.

Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

There is a growing trend of cyberattacks against Internet of Things (IoT) devices; moreover, the sophistication and motivation of those attacks is increasing. The vast scale of IoT, diverse hardware and software, and being typically placed in uncontrolled environments make traditional IT security mechanisms such as signature-based intrusion detection and prevention systems challenging to integrate. They also struggle to cope with the rapidly evolving IoT threat landscape due to long delays between the analysis and publication of the detection rules. Machine learning methods have shown faster response to emerging threats; however, model training architectures like cloud or edge computing face multiple drawbacks in IoT settings, including network overhead and data isolation arising from the large scale and heterogeneity that characterizes these networks.This work presents an architecture for training unsupervised models for network intrusion detection in large, distributed IoT and Industrial IoT (IIoT) deployments. We leverage Federated Learning (FL) to collaboratively train between peers and reduce isolation and network overhead problems. We build upon it to include an unsupervised device clustering algorithm fully integrated into the FL pipeline to address the heterogeneity issues that arise in FL settings. The architecture is implemented and evaluated using a testbed that includes various emulated IoT/IIoT devices and attackers interacting in a complex network topology comprising 100 emulated devices, 30 switches and 10 routers. The anomaly detection models are evaluated on real attacks performed by the testbed’s threat actors, including the entire Mirai malware lifecycle, an additional botnet based on the Merlin command and control server and other red-teaming tools performing scanning activities and multiple attacks targeting the emulated devices.

Anomaly-based Network Intrusion Detection System using Deep Intelligent Technique

Background and objectives: Computer systems and network infrastructures are still exposed to many security risks and cyber-attack vulnerabilities despite advancements of information security. Traditional signature-based intrusion detection systems and security solutions by matching rule-based mechanism and prior knowledge are insufficient of fully protecting computer networks against novel attacks. For this purpose, Anomaly-based Network Intrusion Detection System (A-NIDS) as cyber security tool is considered for identifying and detecting anomalous behavior in the flow-based network traffic alongside with firewalls and other security measures. The main objective of the research is to improve the detection rate and reduce false-positive rates of the classifier using anomaly-based technique. Methods: an intelligent technique using deep learning algorithm and mutual information feature selection (MIFS) method to select optimal features on the benchmark datasets. Proposed method accurately capable of classifying normal and anomalous states of the data packets in a comprehensive way by combination of Long-Short term memory (LSTM) algorithm and MIFS method. Results: The model achieved encouraging results in terms of accuracy 99.79%, 0.002 false-positive rate with minimum time compared to other models recorded only 81.75s on CSE-CIC-IDS2018 dataset. At the end of the study, comparative studies are conducted to verify the effectiveness of proposed method on three realistic and latest intrusion detection datasets, named CSE_CIC-IDS2018, CIC-IDS2017, and NF-CSE-CIC-IDS2018 dataset. Conclusions: Proposed model in a combination of LSTM NN and Feature selection method (MIFS) increased detection rate and reduced false-positive alarms, also the model able to detect low frequent attacks while other existing models are suffering from.

Machine Learning for the Identification of Network Anomalies

The most popular technique for identifying and blocking malicious network requests is the intrusion detection system, or IDS for short. They are positioned carefully to keep an eye on network traffic going to and coming from every device. Most networking devices can employ an IDS with the use of virtual machines and sophisticated switches. While having good accuracy, the classic SIDS (Signature-Based Intrusion Detection System) cannot identify many modern incursions, such as zero-day attacks, as it relies on a pattern matching technique. Instead, the majority of recently launched attacks can be detected using machine learning, statistical, and knowledge-based methods. An anomaly is defined as any significant difference between the observed behavior and the model.The training phase and the testing phase make up the two stages of the development of these models. During the training phase, a model of typical behavior is learned using the average traffic profile. The system's ability to generalize to as-yet-undiscovered intrusions is then determined during the testing step using a fresh data set. In order to identify network traffic anomalies, we have used an unsupervised machine-learning approach called Isolation Forest in this paper. Using the anomaly score, the algorithm finds the outliers. The KDD data set, a well-known benchmark in the study of Intrusion Detection methods, has been used for training and testing. Keywords: anomaly detection; machine learning; network security

A Novel Intrusion Detection System Using Multiple Linear Regression

The internet is no doubt the biggest and the most important tool of modern civilisation. But along with its numerous benefits, it also comes with its own set of risks, the most important of them being breaches in security and privacy. An anomaly-based Intrusion Detection System (IDS) is a type of security system that is used to detect and alert on unusual or abnormal behaviour that may indicate an attack or intrusion. Unlike signature-based IDS, which rely on known patterns of attack, anomaly-based IDS is designed to detect previously unseen or unknown attacks by identifying deviations from normal patterns of behaviour. Multiple linear regression is a statistical technique used to analyse the relationship between a dependent variable and multiple independent variables. In this technique, a linear equation is established between the dependent variable and multiple independent variables, with the aim of predicting the value of the dependent attribute for a given set of values of the independent attribute. In this paper, we collected a data set of 125974 entries and 42 attributes from Kaggle, pre-processed the data and used logistic regression to predict the dependent variable (called xAttack) using 25 independent variables, as we found a high correlation between the aforementioned variables The results are simulated using 10-fold cross validation, using various train test splits of the data set. The data has been split into 80-20,50-50, and 66-34. After testing the given data set in different train test splits, an accuracy of 92.73 was achieved.