Intrusion Detection Scheme Research Articles

An Intrusion Detection Scheme Based on Repeated Game in Smart Home

Smart Home brings a new people-oriented home life experience. However, the edge devices in this system are facing severe threats such as data security and equipment safety. To solve the above problems, this paper proposes an intrusion detection scheme based on repeated game. We first use the K-Nearest Neighbors (KNN) algorithm to classify edge devices and equip the intrusion detection system to cluster heads. Secondly, we use the regret minimization algorithm to determine the mixed strategy Nash equilibrium of the one-order game and then take a severe punishment strategy to domesticate malicious attackers. Thirdly, the intrusion detection system can detect malicious attackers by reduction of payoff. Finally, the detailed experimental results show that the proposed scheme can reduce the loss of attacked intrusion detection system and then achieve the purpose of defending against the attacker.

Machine Learning-Driven Optimization for Intrusion Detection in Smart Vehicular Networks

An essential element in the smart city vision is providing safe and secure journeys via intelligent vehicles and smart roads. Vehicular ad hoc networks (VANETs) have played a significant role in enhancing road safety where vehicles can share road information conditions. However, VANETs share the same security concerns of legacy ad hoc networks. Unlike exiting works, we consider, in this paper, detection a common attack where nodes modify safety message or drop them. Unfortunately, detecting such a type of intrusion is a challenging problem since some packets may be lost or dropped in normal VANET due to congestion without malicious action. To mitigate these concerns, this paper presents a novel scheme for minimizing the invalidity ratio of VANET packets transmissions. In order to detect unusual traffic, the proposed scheme combines evidences from current as well as past behaviour to evaluate the trustworthiness of both data and nodes. A new intrusion detection scheme is accomplished through a four phases, namely, rule-based security filter, Dempster–Shafer adder, node’s history database, and Bayesian learner. The suspicion level of each incoming data is determined based on the extent of its deviation from data reported from trustworthy nodes. Dempster–Shafer’s theory is used to combine multiple evidences and Bayesian learner is adopted to classify each event in VANET into well-behaved or misbehaving event. The proposed solution is validated through extensive simulations. The results confirm that the fusion of different evidences has a significant positive impact on the performance of the security scheme compared to other counterparts.

A trusted feature aggregator federated learning for distributed malicious attack detection

With the rapid development of IoT technology, millions of physical devices embedded with electronics or software are put into regular production. Each IoT device is connected to the user’s life and property privacy. Without a credible intrusion detection and defense mechanism installed on the device, it may be attacked by hackers, such as monitoring events of home cameras and control of smart devices. These attack events will have a serious impact on users’ production and life. This paper proposes a Blockchained-Federated Learning based cloud intrusion detection scheme. The scheme sends the local training parameters of the IoT intrusion alarm set to the cloud computing center for global prediction, and stores the model training process information and behavior on the blockchain. In order to solve the high probability of false alerts affecting the accuracy of the federated learning model, the scheme proposes an alert filter identification module. At the same time, through the erasure code-based blockchain storage solution, the traditional blockchain storage performance is improved to meet the storage needs of a large number of alert training data in real scenarios.

Internet of Things Intrusion Detection: Centralized, On-Device, or Federated Learning?

With the ever increasing number of cyber-attacks, internet of Things (ioT) devices are being exposed to serious malware, attacks, and malicious activities alongside their development. While past research has been focused on centralized intrusion detection assuming the existence of a central entity to store and perform analysis on data from all participant devices, these approaches cannot scale well with the fast growth of ioT connected devices and introduce a single-point failure risk that may compromise data privacy. Moreover, with data being widely spread across large networks of connected devices, decentralized computations are very much in need. in this context, we propose in this article a Federated Learning based scheme for ioT intrusion detection that maintains data privacy by performing local training and inference of detection models. in this scheme, not only privacy can be assured, but also devices can benefit from their peers' knowledge by communicating only their updates with a remote server that aggregates the latter and shares an improved detection model with participating devices. We perform thorough experiments on an NSL-KDD dataset to evaluate the efficiency of the proposed approach. Experimental results and empirical analysis explore the robustness and advantages of the proposed Federated Learning detection model by reaching an accuracy close to that of the centralized approach and outperforming the distributed unaggregated on-device trained models.

Detection of Low-Frequency and Multi-Stage Attacks in Industrial Internet of Things

The increasingly sophisticated cyber attacks have become a serious challenge for Industrial Internet of Things (IIoT), which presents two new characteristics: low frequency and multi-stage. That is, hackers could gain authority to attack industrial equipment/infrastructure gradually in a long interval through lurking, lateral intrusion and privilege escalation. While, the existing Machine Learning (ML) based intrusion detection schemes all require the participation of expert knowledge, so it is difficult to adaptively select an attack interval and a retraining period of the detection model in IIoT, resulting in poor detection performance. To solve above problems, a bidirectional long and short-term memory network with multi-feature layer (B-MLSTM) is designed. Firstly, sequence and stage feature layers are introduced in the model training phase model which can learn the corresponding attack interval from historical data, so that the model can effectively detect attacks with different intervals. Then, a double-layer reverse unit is introduced to update the detection model. By collecting information from test data and making association analysis with historical data, the retraining period is adaptively selected to match the new attack interval. Compared with the previous works, our proposed scheme has a lower false positive rate than existing schemes by at least 46.79%, and the false negative rate is reduced by at least 79.85%, which are carried out on three classic IIoT datasets.

Diverse Methods for Signature based Intrusion Detection Schemes Adopted

Intrusion Detection Systems (IDS) is used as a tool to detect intrusions on IT networks, providing support in network monitoring to identify and avoid possible attacks. Most such approaches adopt Signature-based methods for detecting attacks which include matching the input event to predefined database signatures. Signature based intrusion detection acts as an adaptable device security safeguard technology. This paper discusses various Signature-based Intrusion Detection Systems and their advantages; given a set of signatures and basic patterns that estimate the relative importance of each intrusion detection system feature, system administrators may help identify cyber-attacks and threats to the network and Computer system. Eighty percent of incidents can be easily and promptly detected using signature-based detection methods if used as a precautionary phase for vulnerability detection and twenty percent rest by anomaly-based intrusion detection system that involves comparing definitions of normal activity or event behavior with observed events in identifying the significant deviations and deciding the traffic to flag.

Transfer learning based intrusion detection scheme for Internet of vehicles

As a new type of network, the types of attack in the Internet of Vehicles (IoV) are constantly emerging and changing. Consequently, the machine learning based intrusion detection model has to update to cope with new attacks. However, existing machine learning based IoV intrusion detection schemes require large amounts of labeled data to complete model updates. For new attacks, the IoV cloud is also difficult to identify in time, which requires a lot of labor and time cost in IoV. To solve above issue, this paper employs transfer learning and proposes two model update schemes based on whether the IoV cloud can timely provide a small amount of labeled data for a new attack. The first one is the cloud-assisted update scheme where the IoV cloud can provide a small amount of data. And the second one is the local update scheme where the IoV cloud cannot provide any labeled data timely. In this paper, the local update scheme obtains pseudo label of the unlabeled data in new attacks via pre-classifies and uses the pseudo-labeled data for multiple rounds of transfer learning. Then the vehicle can complete the update without obtaining any labeled data through the IoV cloud. The experimental results show that compared with the existing method, our two schemes have improved the detection accuracy by at least 23%.

An intrusion detection scheme based on the ensemble of discriminant classifiers

The cyber-physical system and modern technology are useful in various applications of the network. However, various types of bugs and vulnerabilities are also brought along with modern technologies. The attacks caused by vulnerabilities create huge losses, necessitating the need to detect these attacks. Although, considerable work has been done by the researchers so far, but novel attacks are yet to be detected. Existing schemes are suitable for denial of service (DOS) type of attack class. However, these schemes are not efficiently detecting other types of attack classes such as Probing, Remote to User (R2L) and User to Root (U2R). In view of this, a new intrusion detection scheme based on ensemble of discriminant classifiers is proposed in this paper. In ensemble of discriminant classifier method, weak learners are converted into strong learners. KDDcup99 dataset has been used in the proposed scheme for empirical evaluation. The results show that the proposed scheme is superior in detecting all types of attack classes by achieving 98.9% overall accuracy.Network security, Cyber-physical system, Intrusion detection, Ensemble methods, Discriminant classifier, Denial of service (DOS)

Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the Industry 4.0. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.

Privacy‐preserving multisource transfer learning in intrusion detection system

AbstractThe increasing scale of the network and the demand for data privacy‐preserving have brought several challenges for existing intrusion detection schemes, which presents three issues: large computational overhead, long training period, and different feature distribution which leads low model performance. The emergence of transfer learning has solved the above problems. However, the existing transfer learning‐based schemes can only operate in plaintext when different domains and clouds are untrusted entities, the privacy during data processing cannot be preserved. Therefore, this paper designs a privacy‐preserving multi‐source transfer learning intrusion detection system (IDS). Firstly, we used the Paillier homomorphic to encrypt models which trained from different source domains and uploaded to the cloud. Then, based on privacy‐preserving scheme, we first proposed a multisource transfer learning IDS based on encrypted XGBoost (E‐XGBoost). The experimental results show that the proposed scheme can successfully transfer the encryption models from multiple source domains to the target domain, and the accuracy rate can reach 93.01% in ciphertext, with no significant decrease in detection performance compared with works in plaintext. The training time of the model is significantly reduced from the traditional hour‐level to the minute‐level.

Analysis and Determination of Recent Developments on Intrusion Detection Schemes in Cloud Environment

Analysis and Determination of Recent Developments on Intrusion Detection Schemes in Cloud Environment

PREVENTION MECHANISM OF BLACK HOLE AND JAMMING ATTACK IN MOBILE AD HOC NETWORK

Mobile ad hoc network (MANET) is more susceptible to severe kind of security threats like denial of service attack, black hole attack, jamming attack and Sybil attack because of its dynamic behavior and lack of central administration. In such network any number of nodes can join or leave the network easily. In this paper, focuses on the prevention of black hole and jamming attack which is one of the serious threats. Black hole node advertises itself that it has the shortest route to destination while jamming occurs due to uninterrupted radio waves to put down the transmission between receiver and sender. We propose IDPS (Intrusion Detection and Prevention Scheme) scheme to thwart the black hole node and Distributed monitoring mechanism to choose monitor nodes responsible for identifying channel accessibility. The proposed security scheme is able to handle the jamming attack conditions and resolve the problem of link blockage from jamming. The simulation & analysis of proposed work is performed on NS-2.34 network simulator and it is found that our proposed scheme outperforms in prevention for black hole and identifying the jamming nodes.

Detection of Multiple Attackers and Provide Security for UAV Networks

Remote controlled aerial vehicle networks haven’t received right smart analysis attention. Specifically, security problem area unit is a serious concern as a result of such networks that carry very important data square measure at risk of numerous attacks. In our projected system to style and implemented a novel Location –Aided Delay Tolerant Routing Protocol(LADTR) with intrusion detection and response scheme, that operates at the UAV(Unmanned Aerial Vehicle)and ground station level, to find spiteful anomalies that menace the network. And conjointly UAV networks to be used in post-disaster operation, which combined with Store Carry Forward (SCF) techniques. During this theme, a group of detection and response techniques square measure projected to observe the UAV behaviors and reason them into appropriate list (normal, abnormal, suspect, malicious) in keeping with the detected cyber attack. Our simulation result make sure that the projected theme performs well in terms of attack detection even with an oversized range of UAVs and attackers since it exhibits a high detection rate , an occasional range of false positives, and prompt detection overhead and conjointly improve the packet delivery magnitude relation, network time period.

An approach for optimal-secure multi-path routing and intrusion detection in MANET

Mobile ad-hoc network (MANET) is dynamic in nature that is susceptible to energy and security constraints. Among most of the existing techniques, energy optimization was a hectic challenge, which is addressed effectively using the routing protocols. Accordingly, this paper proposes an effective multipath routing protocol in MANET based on an optimization algorithm. The energy and the security crisis in the MANET are addressed effectively using the cluster head (CH) selection and intrusion detection strategies namely, fuzzy clustering and fuzzy Naive Bayes (fuzzy NB). Then, the multipath routing progresses using the secure nodes based on the routing protocol, Bird swarm-whale optimization algorithm (BSWOA), which is the integration of bird swarm optimization (BSA) in whale optimization algorithm (WOA). The selection of the optimal routes is based on fitness factors, such as connectivity, energy, trust, and throughput. The analysis of the methods is done using the attacks, such as flooding, blackhole, and selective packet drop based on the performance metrics. The proposed BSWOA acquired the maximal energy, throughput, detection rate, and a minimal delay of 9.48 Joule, 0.676 bps, 69.9%, and 0.00372 ms in the presence of the attack.

Designing Efficient Sinkhole Attack Detection Mechanism in Edge-Based IoT Deployment.

The sinkhole attack in an edge-based Internet of Things (IoT) environment (EIoT) can devastate and ruin the whole functioning of the communication. The sinkhole attacker nodes (s) have some properties (for example, they first attract the other normal nodes for the shortest path to the destination and when normal nodes initiate the process of sending their packets through that path (i.e., via ), the attacker nodes start disrupting the traffic flow of the network). In the presence of s, the destination (for example, sink node i.e., gateway/base station) does not receive the required information or it may receive partial or modified information. This results in reduction of the network performance and degradation in efficiency and reliability of the communication. In the presence of such an attack, the throughput decreases, end-to-end delay increases and packet delivery ratio decreases. Moreover, it may harm other network performance parameters. Hence, it becomes extremely essential to provide an effective and competent scheme to mitigate this attack in EIoT. In this paper, an intrusion detection scheme to protect EIoT environment against sinkhole attack is proposed, which is named as SAD-EIoT. In SAD-EIoT, the resource rich edge nodes (edge servers) perform the detection of different types of sinkhole attacker nodes with the help of exchanging messages. The practical demonstration of SAD-EIoT is also provided using the well known NS2 simulator to compute the various performance parameters. Additionally, the security analysis of SAD-EIoT is conducted to prove its resiliency against various types of s. SAD-EIoT achieves around detection rate and false positive rate, which are considerably better than other related existing schemes. Apart from those, SAD-EIoT is proficient with respect to computation and communication costs. Eventually, SAD-EIoT will be a suitable match for those applications which can be used in critical and sensitive operations (for example, surveillance, security and monitoring systems).

SH-IDS: Specification Heuristics Based Intrusion Detection System for IoT Networks

The loosely coupled independent hardware of any kind under internet protocol refers to the Internet of Things (IoT). The IoT network has often framed by the composition of various standards, techniques, and services that are having diversified privacy & security prerequisites. Therefore, it has noted that paradigm IoT has similar problems of security as cloud services, the internet, and “mobile communication networks”. Nevertheless, the outdated countermeasures of security, & implementation of privacy cannot be applied directly to the technologies of IoT because of confined IoT elements computing power, the maximum amount of interrelated devices & data sharing among users & objects. The proposals of IDS for the IoT will be placed to be distributed or central system or in the combination of bi-phase systems. The traditional intrusion detection strategies detect intrusion either by signature, anomalies, or a combination of any of these. Due to the limited resources of the devices placed in IoT networks, the intrusion detection strategies should perform the intrusion defense under the constrained resources of the corresponding devices. Regarding this argument, a novel specification measure that allows each of the devices falls in an IoT network to defend the intrusion at a corresponding device level. The method explored in this manuscript is a specification approach that determines Specification Heuristics to assess the scope of intrusion in IoT network requests.

A Smart Approach for Intrusion Detection and Prevention System in Mobile Ad Hoc Networks Against Security Attacks

Design of intrusion detection and prevention scheme for improving MANET security, with considered energy efficiency, detection rate, delay, and false positive rate are major research issues. Most of the existing solutions have suffered to obtain accurate detection rate in minimal time execution and energy consumption. In this work we proposed a Smart approach for intrusion detection and prevention system (SA-IDPS) to mitigate attacks in MANET by machine learning methods. Initially, mobile users are registered in Trusted Authority using One Way Hash Chain Function. Each mobile user submits their following information to verify authentication: finger vein biometric, user id, and latitude and longitude. Intrusion detection is executed using four entities: Packet Analyzer, Preprocessing Unit, Feature Extraction Unit and Classification Unit. In packet analyzer, we verify whether any attack pattern is found or not. It is implemented using Type 2 Fuzzy Controller which considers information from packet header. In preprocessing unit, logarithmic normalization and encoding schemes are considered, which is time series and suitable for any application. In feature extraction unit, Mutual Information is used where we extracts optimum set of features for packets classification. In classification unit, Bootstrapped Optimistic Algorithm for Tree Construction with Artificial Neural Network is used for packets classification, which classifies packets five classes: DoS, Probe, U2R, R2L, and Anomaly, and then Association Rule Tree are used to classify whether the attack is Frequent or Rare. In this case, historical table is used for packets classification. Finally, experiments are conducted and tested for evaluating the performance of proposed SA-IDPS scheme in terms of Detection Rate (%), False Positive Rate (%), Detection Delay (s), and Energy Consumption (J).

TIDCS: A Dynamic Intrusion Detection and Classification System Based Feature Selection

Machine learning techniques are becoming mainstream in intrusion detection systems as they allow real-time response and have the ability to learn and adapt. By using a comprehensive dataset with multiple attack types, a well-trained model can be created to improve the anomaly detection performance. However, high dimensional data present a significant challenge for machine learning techniques. Processing similar features that provide redundant information increases the computational time, which is a critical problem especially for users with constrained resources (battery, energy). In this paper, we propose two models for intrusion detection and classification scheme Trust-based Intrusion Detection and Classification System (TIDCS) and Trust-based Intrusion Detection and Classification System- Accelerated (TIDCS-A) for secure network. TIDCS reduces the number of features in the input data based on a new algorithm for feature selection. Initially, the features are grouped randomly to increase the probability of making them participating in the generation of different groups, and sorted based on their accuracy scores. Only the high ranked features are then selected to obtain a classification for any received packet from the nodes in the network, which is saved as part of the node’s past performance. TIDCS proposes a periodic system cleansing where trust relationships between participant nodes are evaluated and renewed periodically. TIDCS-A proposes a dynamic algorithm to compute the exact time for nodes cleansing states and restricts the exposure window of the nodes. The final classification decision for both models is estimated by incorporating the node’s past behavior with the machine learning algorithm. Any detected attack reduces the trustworthiness of the nodes involved, leading to a dynamic system cleansing. An evaluation of TIDCS and TIDCS-A using the NSL-KDD and UNSW datasets shows that both models can detect malicious behaviors providing higher accuracy, detection rates, and lower false alarm than state-of-art techniques. For instance, for UNSW dataset, the accuracy detection is 91% for TICDS, 83.47%by using online AODE, 88% for CADF, 90% for EDM, 90% for TANN and 69.6% for NB. Consequently, TICDS has better performance than the state of art techniques in terms of accuracy detection, while providing good detection and false alarm rates.

A Distributed Intrusion Detection Scheme for Cloud Computing

Intrusion detection systems (IDS) is an important security measure used to secure cloud resources, however, IDS often suffer from poor detection accuracy due to coordinated attacks such as a DDoS. Various research on distributed IDSs have been proposed to detect DDoS however, the limitations of these works the lack of technique to determine an appropriate period to share attack information among nodes in the distributed IDS. Therefore, this article proposes a distributed IDS that uses a binary segmentation change point detection algorithm to address the appropriate period to send attack information to nodes in distributed IDS and using parallel Stochastic Gradient Descent with Support Vector Machine (SGD-SVM) to achieve the distributed detection. The result of the proposed scheme was implemented in Apache Spark using NSL-KDD benchmark intrusion detection dataset. Experimental results show that the proposed distributed intrusion detection scheme outperforms existing distributed IDS for cloud computing.

Cyber-Physical Integrated Intrusion Detection Scheme in SCADA System of Process Manufacturing Industry

Most Intrusion Detection System(IDS) used in Supervisory Control and Data Acquisition (SCADA) systems now are focused on the cyber field but ignored the process states in physical field of the plants. Attacks aiming at the protocol traffics can be detected but attacks aiming at the processes are difficult to be detected such as the Man In The Middle (MITM) attacks and the Replay attacks. We propose a scheme in both cyber way and physical way to detect the above attacks. Validation of process states is used to detect malicious behaviors to prevent the physical components from being damaged which can be caused by MITM, Replay, and Zero-day attacks. Nonparallel hyperplane based fuzzy classifier is presented to realize the classification of branching shaped data sets which are difficult to be classified by two parallel hyperplane of Support Vector Machine(SVM) to detect attacks caused by DoS (SYN flood) and other attacks in cyber field. Modbus/TCP traffic data are used to test the algorithm and simulation process states are used to test the validation part and the performance of this hybrid scheme is excellent.