Intrusion Detection System Techniques Research Articles

XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems

The exponential growth of network intrusions necessitates the development of advanced artificial intelligence (AI) techniques for intrusion detection systems (IDSs). However, the reliance on AI for IDSs presents several challenges, including the performance variability of different AI models and the opacity of their decision-making processes, hindering comprehension by human security analysts. In response, we propose an end-to-end explainable AI (XAI) framework tailored to enhance the interpretability of AI models in network intrusion detection tasks. Our framework commences with benchmarking seven black-box AI models across three real-world network intrusion datasets, each characterized by distinct features and challenges. Subsequently, we leverage various XAI models to generate both local and global explanations, shedding light on the underlying rationale behind the AI models’ decisions. Furthermore, we employ feature extraction techniques to discern crucial model-specific and intrusion-specific features, aiding in understanding the discriminative factors influencing the detection outcomes. Additionally, our framework identifies overlapping and significant features that impact multiple AI models, providing insights into common patterns across different detection approaches. Notably, we demonstrate that the computational overhead incurred by generating XAI explanations is minimal for most AI models, ensuring practical applicability in real-time scenarios. By offering multi-faceted explanations, our framework equips security analysts with actionable insights to make informed decisions for threat detection and mitigation. To facilitate widespread adoption and further research, we have made our source code publicly available, serving as a foundational XAI framework for IDSs within the research community.

Advancements in Machine Learning Techniques for Intrusion Detection Systems: An Overview of Perspectives and Datasets

Advancements in Machine Learning Techniques for Intrusion Detection Systems: An Overview of Perspectives and Datasets

Exploring Lightweight Deep Learning Techniques for Intrusion Detection Systems in IoT Networks: A Survey

The proliferation of Internet users has coincided with a commensurate increase in the amount of very important, sensitive, and private information being transferred across the Internet. Malicious actors are increasingly targeting networks to breach them and obtain illegal access to critical information since this trend has revealed holes in security systems. In addition to endangering the privacy of the data concerned, these breaches disrupt the smooth functioning of systems. Therefore, in light of these dangers, intrusion detection systems (IDSs) are now an essential part of any cybersecurity program. The goal of these systems is to detect and report any suspicious activity by constantly monitoring and analyzing network traffic. Numerous review articles have investigated various methods for network intrusion detection. To improve detection accuracy while keeping computing efficiency high, this survey study investigates lightweight deep learning techniques for intrusion detection systems. These techniques include pruning, quantization, clustering, and collaborative optimization. This study analyzes five different types of new real-world traffic datasets (i.e., CSE-CIC- IDS2018, NSL-KDD, Bot-IoT, ToN IoT Network, and UNSW-NB15) and evaluates the performance of several machine learning and deep learning techniques. This survey provides metrics for measuring the accuracy of intrusion detection across various systems, which may be used to assess performance.

A Study of Role and Applicability of Data Mining Techniques in Intrusion Detection Systems

Abstract: The swift development of computers technologies changed the way data and information were kept. The risk of this data being exposed to uninvited and unauthorized users arises with this new paradigm of data access. Numerous systems have been created that examine data to look for deviations from a user's or system's typical behavior or look for a known signature in the data. Intrusion Detection Systems (IDS) is the name given to these systems. These systems use a variety of approaches, including machine learning algorithms and statistical methodologies. With the massive rise in the use of network-based services and information sharing on networks, network security has emerged as the fundamental component. The integrity, confidentiality, and availability of computer and network resources are all seriously compromised by intrusion, which also poses a severe risk to network security. Network audit data classification by humans is a costly, time-consuming, and laborious task. An intrusion detection system (IDS) is one tool used to find anomalies and attacks on a network. The network intrusion detection system has made extensive use of data mining techniques to extract valuable information from vast amounts of network data. This work proposes a hybrid model that combines two distinct intrusion detection techniques: anomaly-based and signaturebased. The model is separated into two stages. Systems for detecting intrusions make use of audit data produced by network devices, operating systems, and application software. These sources generate enormous databases that contain tens of millions of records. Data mining, which is the process of extracting meaningful patterns from a sizable amount of information, is used to analyze this data. The presented paper deals with the role and the applicability of data mining techniques in designing and developing the IDS Systems.

Machine Learning-Based Intrusion Detection on Multi-Class Imbalanced Dataset Using SMOTE

The rapid development of information technology has brought numerous benefits to society, but it has also led to increased security vulnerabilities in network systems. Intrusion detection systems (IDS) play a crucial role in identifying malicious activities, but they face challenges due to imbalanced datasets where the number of attack samples outweighs normal activities. This paper explores the performance of an IDS using SMOTE (Synthetic Minority Over-sampling Technique) and various classification algorithms to address imbalanced datasets and enhance detection of multi-class intrusions. Related works in the field of intrusion detection are reviewed, highlighting the effectiveness of different algorithms and techniques. The proposed work presents a model that combines SMOTE with log normalization and feature selection to improve IDS performance. Experiments are conducted on the NSL-KDD and CIC-IDS2017 datasets, evaluating different oversampling configurations and machine learning models. The results show that applying SMOTE improves overall performance, with high accuracy, precision, recall, and F1-score. Feature selection has minimal impact on model performance, suggesting the presence of redundant features. The study concludes that SMOTE effectively addresses class imbalance and enhances IDS performance, emphasizing the importance of incorporating oversampling techniques in intrusion detection systems.

Evaluated bird swarm optimization based on deep belief network (EBSO-DBN) classification technique for IOT network intrusion detection

Because of the recent development of various intrusion detection systems (IDS), which defend computer networks from security as well as privacy threats. The confidentiality, integrity and also availability of data may be compromised in the case that IDS prevention efforts fail. The amount of private, delicate and crucial data travelling over the worldwide network has expanded tremendously as a result of the recent development of Internet of Things (IoT) devices. Developing a better edge-based feature selection strategy, a deep learning technique for identifying and blocking malicious traffic, is the goal of intrusion detection. The classification method Evaluated Bird Swarm Optimization based Deep Belief Network (EBSO-DBN) has shown to be the most successful in this study. A variation of performance criteria have been used to critically assess deep learning techniques for IDS (accuracy, precision, recall, f-1 score, false alarm rate and detection rate). To ascertain the optimal performance of IDS models, this study focuses on building an ensemble classifier utilizing the suggested EBSO-DBN classification algorithm with 98.7% of accuracy, 99.4% of precision and 98.8% of recall.

Review on Clustering and Classification techniques in Intrusion Detection Systems

In the modern cyber world, the proportion of security threats is cumulating every day, and many researchers and security specialists are focusing on IDS (Intrusion Detection Systems) and the patterns in recognizing the alerts / events to detect and prevent them. The researchers and security specialists believe that the IDS is best way to protect the network and information assets. Hence this paper is focused on various threats and potential of IDS with its patterns in detecting the alerts / events. Basically, IDS has three different styles in detection the threats: Signature-based Detection (SD), Anomaly-based Detection (AD), and Stateful Protocol Analysis (SPA). The main area where the researchers and security specialists focusing is on techniques and algorithms used for clustering and classification. This paper mainly supports in understanding and analysing the various patterns on clustering and classifying the previous alerts / events which mainly supports in detection of threats with accuracy. This review will help to increase the detection accuracy of the IDS by enhancing the clustering and classification techniques which supports efficient execution of IDS over the network

Deep Learning Towards Intrusion Detection System (IDS): Applications, Challenges and Opportunities

With the growth of numerous technological areas, including sensors, embedded computing, broadband Internet access, wireless communications, distributed services, automatic identification, and tracking, the potential for integrating smart objects into our daily activities through the Internet has increased. The Internet of Things (IoT) is the confluence of the Internet and intelligent objects that can converse and cooperate with one another. IoT is a brand-new example that unifies Cyberspace with actual physical objects from various areas, including, business processes, human health, home automation, and environmental monitoring. It intensifies the use of Internet-connected strategies in our regular lives, carrying with it several advantages as well as security challenges. Intrusion Detection Systems (IDS) have been a crucial device for the defence of systems and material schemes for more than 20 years. However, applying traditional IDS techniques was challenging due to the IoT’s inimitable features, like resource-constrained devices and particular protocol stacks and standards. As a result, this survey will focus on various Deep Learning (DL)-based intrusion detection techniques. This study makes use of 50 research papers that focused on different techniques, and a review of studies that used those techniques was given. This research enables categorizing the methods employed for intrusion detection in IoT based on Convolutional Neural Network (CNN)-based methods, Deep Neural Network (DNN)-based methods, Optimization-based methods, and so on. Moreover, the categorization of approaches, published year, the dataset used, tools used, and the performance metrics are measured for intrusion detection in IoT. On the basis of the software used for implementation, performance achievement, and other factors, a thorough analysis was conducted. The conclusion identifies the research gaps and issues in a way that makes it clear why should create an efficient method for enabling efficient enhancement.

A review of deep learning based intrusion detection systems

Network security is a key issue in the era of rapid Internet development and new technologies are needed to enhance the security protection of network systems. As the first line of defence for the security of network systems, IDS is considered to be one of the important network tools for managing network security. Traditional network intrusion detection methods usually use machine learning techniques. However, deep learning, a more powerful machine learning method, has the advantages of mature technology, wide applicability and high accuracy, and has shown its advantages in various fields such as image recognition, natural language processing and computer vision. It can also be applied to network security detection, as it can effectively handle large-scale, complex datas and detect unknown, sophisticated network attacks. This paper will provide a summary of machine learning techniques and deep learning techniques in intrusion detection systems, as well as examples of IDSs using deep learning, and conclude with a summary and outlook.

A new two-phase intrusion detection system with Naïve Bayes machine learning for data classification and elliptic envelop method for anomaly detection

Technology is pivotal in the rapid growth of services and intensifying the quality of life. Recent technology, like the Internet of Things (IoT), demonstrates an impressive performance in fast-forward development. Intrusion Detection System (IDS) is used as a lifeline to prevent attacks by classifying the activities as normal and suspicious. In this paper, we propose a two-phase IDS for IoT. In the first phase, we categorize data into four sections according to the data types (i.e., nominal, integer, binary, and float). We then classify them using different versions of the Naive Bayes classifier. After that, we use majority voting to choose the final result of the classification. In the second phase, we pass those data which behave normally or are benign in the first phase and classify them using an unsupervised elliptic envelope. We validated our work using the standard NSL-KDD, UNSW_NB15, and CIC-IDS2017 datasets. We found the proposed method more efficient than existing IDS techniques and achieved reasonable accuracy in the first phase. Furthermore, the benign data is sent to the second phase of the analysis. After the second phase, we achieved a 97% accuracy in the NSL-KDD dataset, 86.9% in the UNSW_NB15 dataset, and 98.59% accuracy in the CIC-IDS2017 dataset.

An ensemble deep learning based IDS for IoT using Lambda architecture

The Internet of Things (IoT) has revolutionized our world today by providing greater levels of accessibility, connectivity and ease to our everyday lives. It enables massive amounts of data to be traversed across multiple heterogeneous devices that are all interconnected. This phenomenon makes IoT networks vulnerable to various network attacks and intrusions. Building an Intrusion Detection System (IDS) for IoT networks is challenging as they enable a massive amount of data to be aggregated, which is difficult to handle and analyze in real time mainly because of the heterogeneous nature of IoT devices. This inefficient, traditional IDS approach accentuates the need to develop advanced IDS techniques by employing Machine or Deep Learning. This paper presents a deep ensemble-based IDS using Lambda architecture by following a multi-pronged classification approach. Binary classification uses Long Short Term Memory (LSTM) to differentiate between malicious and benign traffic, while the multi-class classifier uses an ensemble of LSTM, Convolutional Neural Network and Artificial Neural Network classifiers to detect the type of attacks. The model training is performed in the batch layer, while real-time evaluation is carried out through model inferences in the speed layer of the Lambda architecture. The proposed approach gives high accuracy of over 99.93% and saves useful processing time due to the multi-pronged classification strategy and using the lambda architecture.

Analysis on Intrusion Detection Systems to Secure IoT Networks

The amalgamation of physical objects and the internet constitutes the Internet of things(IoT). In the subsequent times, more such physical objects will be connected to the internet and this will lead to the escalation in the attacks carried out on IoT devices and network. This is mainly due to the less memory and lack in built-in security controls. This has made IoT Security, the most researched topic in the past decade. Thus to protect IoT nodes and networks, a security mechanism called Intrusion Detection System(IDS) is brought in use.The advent of Internet of things has played a crucial role in making the lives of the people more easier and comfortable. It has improved the lives of the people in terms of several aspects like comfort and efficiency. This has overall consequently lead to what is called smart environments. When the case of real world smart environment is discussed, both security and privacy comes into play in being the key issues to be considered. But the need demands for the Intrusion Detection Systems (IDSs) to be designed for the IoT networks or environments to mitigate attack related issues. These are the attacks that exploits the vulnerabilities present in the network. The work here demonstrates the need of the fact that despite having previous technologies, we still lack a secure system that could safeguard IoT networks. In this paper, a detailed analysis is provided on IoT, security attacks in IoT, IDS, types of IDS, Machine learning and Deep learning techniques and algorithms used with IDS in IoT and current trends and research on use of IDS in securing Internet of Things is discussed. Lastly future research based on the current analysis is also examined. Keywords: IoT, IDS, Network, Security, Machine Learning, Deep Learning

A Comparative Study of Current Dataset Used to Evaluate Intrusion Detection System

Today, since the world increasingly depends on computers and automation, securing applications and systems has become critical. The possibility of threat and violence is expanding rapidly due to the growing complexity of modern networks and services. This study focuses on current datasets, the gaps and limitations of these datasets, and their effects on creating Intrusion Detection Systems (IDS). The study outlines the existing datasets that show an apparent absence of real-world threats, attack representation, and outdated threats, limiting the efficiency of machine learning IDS techniques. This work presents the most Machine Learning techniques for implementing IDS and a comprehensive review of the available benchmark datasets. We believe this review will enable future researchers in this field to understand better different kinds of IDS datasets, advantages, and limitations.

Deep Learning for Intrusion Detection and Security of Internet of Things (IoT): Current Analysis, Challenges, and Possible Solutions

In the last decade, huge growth is recorded globally in computer networks and Internet of Things (IoT) networks due to the exponential data generation, approximately zettabyte to a petabyte. Consequently, security issues have also been arisen with the network growth. However, intrusion detection in such big data is challenging. Smart homes, cities, grids, devices, objects, e-commerce, e-banking, e-government, etc., are different advanced applications of the evolving networks. Many Intrusion Detection Systems (IDS) have been developed recently due to most computer networks’ exposure to security and privacy threats. Data confidentiality, integrity, and availability damage will occur in case of IDS prevention failure. Conventional techniques are not effective enough to cope the advanced attacks. Advanced deep learning techniques have been proposed for automatic intrusion detection and abnormal behavior identification of networks. This research aims to provide an inclusive analysis of intrusion detection based on deep learning techniques followed by different intrusion detection systems. In this review, public network-based datasets of IDS are fully explored and analyzed. Deep learning techniques for IDS have been critically evaluated based on different performance metrics (accuracy, precision, recall, f-1 score, false alarm rate, and detection rate). Furthermore, existing challenges and possible solutions for networks security and privacy have been discussed.

Host-based intrusion detection system using Support Vector Machine

In line with the communication industry’s use of recent advancements in network technology to link remote areas of the world, attackers or intruders have stepped up their attacks on networking infrastructure. System administrators might deploy intrusion detection tools and systems to thwart such efforts. In recent years, the use of machine learning (ML) techniques in intrusion detection systems (IDSs) has increased. One of the most popular machine learning (ML) techniques for intrusion detection is the Support Vector Machine (SVM) due to its excellent generalization and capacity to escape the dimensionality curse. Recent studies have shown that the number of dimensions still impacts how well SVM-based intrusion detection systems work. The fact that SVM assesses all data characteristics equally has also caused some concerns. Actual intrusion detection datasets include a lot of redundant or superfluous characteristics. It would be ideal to consider feature weights while training an SVM. Knowledge Discovery in Databases (KDD) intrusion detection dataset offers labeled data for the scientists and researchers; choosing the essential features or patterns from the input dataset makes the problem more straightforward and faster and acquires much more accuracy towards threat detection. Our work demonstrates the efficiency of recognizing the essential input patterns to design a more efficient Intrusion Detection System (IDS). Consequently, removing irrelevant or unimportant inputs makes the problem of detecting a threat simpler, faster, and more accurate. It has been an essential issue in intrusion detection that features selection and ranking must be made accordingly; it is the only way to detect intrusion accurately and efficiently. We implement the procedure to remove one feature at a time to run experiments on a Support Vector Machine (SVM) to grade the significance of the features for the KDD dataset. It has been observed that SVM-based IDSs utilizing fewer features could improve and efficiently perform.

Intrusion Detection Systems in Internet of Things and Mobile Ad-Hoc Networks

Internet of Things (IoT) devices work mainly in wireless mediums; requiring different Intrusion Detection System (IDS) kind of solutions to leverage 802.11 header information for intrusion detection. Wireless-specific traffic features with high information gain are primarily found in data link layers rather than application layers in wired networks. This survey investigates some of the complexities and challenges in deploying wireless IDS in terms of data collection methods, IDS techniques, IDS placement strategies, and traffic data analysis techniques. This paper’s main finding highlights the lack of available network traces for training modern machine-learning models against IoT specific intrusions. Specifically, the Knowledge Discovery in Databases (KDD) Cup dataset is reviewed to highlight the design challenges of wireless intrusion detection based on current data attributes and proposed several guidelines to future-proof following traffic capture methods in the wireless network (WN). The paper starts with a review of various intrusion detection techniques, data collection methods and placement methods. The main goal of this paper is to study the design challenges of deploying intrusion detection system in a wireless environment. Intrusion detection system deployment in a wireless environment is not as straightforward as in the wired network environment due to the architectural complexities. So this paper reviews the traditional wired intrusion detection deployment methods and discusses how these techniques could be adopted into the wireless environment and also highlights the design challenges in the wireless environment. The main wireless environments to look into would be Wireless Sensor Networks (WSN), Mobile Ad Hoc Networks (MANET) and IoT as this are the future trends and a lot of attacks have been targeted into these networks. So it is very crucial to design an IDS specifically to target on the wireless networks.

The Intrusion Detection System by Deep Learning Methods: Issues and Challenges

Intrusion Detection Systems (IDS) are one of the major research application problems in the computer security domain. With the increasing number of advanced network attacks, the improvement of the traditional IDS techniques become a challenge. Efficient ways and methods of identifying, protecting, and analyzing data are needed. In this paper, a comprehensive survey on the application of Machine Learning (ML) and Deep Learning (DL) methods on the IDS to increase detection accuracy and reduce error rate is proposed. The recent research papers that have been published between 2018 and 2021 in the area of applying ML and DL in the IDS are analyzed and summarized. Four main analyzing aspects are presented as follows: (1) IDS concepts and taxonomy. (2) The strength and weaknesses of ML and DL methods. (3) IDS benchmark datasets. (4) Comprehensive review of the most recent articles that used ML and DL to improve IDS with highlighting the strengths and weaknesses of each work. Based on the analysis of the literature review papers, a framework for the application of ML and DL in the IDS is proposed. Finally, the current limitations are discussed and future research directions are provided.

An intelligent cognitive computing based intrusion detection for industrial cyber-physical systems

Advanced developments of Industrial Cyber-Physical Systems (CPSs), comprising Internet of Things (IoT) finds useful in several application areas such as transportation, smart cities, healthcare, energy distribution, agriculture, etc. At the same time, the increased utilization of industrial CPS offers many threats which could have major significances for users. Recently, cognitive computing and artificial intelligence techniques offer new opportunities for the revolution of industrial CPSs. Therefore, to achieve security in industrial CPS, AI based intrusion detection system (IDS) can be developed to detect anomalies and prevent their harmful effects. With this motivation, this paper presents a novel cognitive computing based IDS technique to achieve security in industrial CPS. The proposed model involves different stages of operations such as data acquisition, preprocessing, feature selection, classification, and parameter optimization. The proposed model involves preprocessing to discard the noise that exists in the data. Then, the presented model uses binary bacterial foraging optimization (BBFO) based feature selection technique to elect an optimal subset of features. Besides the gated recurrent unit (GRU) model is applied to identify the presence of intrusions in the industrial CPS environment. Finally, Nesterov-accelerated Adaptive Moment Estimation (NADAM) optimizer is applied for the hyperparameter optimization of the GRU model in such a way that the detection rate can be enhanced. In order to validate the performance of the BBFO-GRU model, a series of experiments were carried out using the data from industrial CPS and the resultant values highlighted the promising performance of the proposed model with an accuracy of 98.45%.

Intelligent Network Intrusion Prevention Feature Collection and Classification Algorithms

Rapid Internet use growth and applications of diverse military have managed researchers to develop smart systems to help applications and users achieve the facilities through the provision of required service quality in networks. Any smart technologies offer protection in interactions in dispersed locations such as, e-commerce, mobile networking, telecommunications and management of network. Furthermore, this article proposed on intelligent feature selection methods and intrusion detection (ISTID) organization in webs based on neuron-genetic algorithms, intelligent software agents, genetic algorithms, particulate swarm intelligence and neural networks, rough-set. These techniques were useful to identify and prevent network intrusion to provide Internet safety and improve service value and accuracy, performance and efficiency. Furthermore, new algorithms of intelligent rules-based attributes collection algorithm for efficient function and rules-based improved vector support computer, were proposed in this article, along with a survey into the current smart techniques for intrusion detection systems.

Secure Opportunistic Watchdog Production in Wireless Sensor Networks: A Review

Finding the security vulnerabilities and solving the issues in Wireless Sensor Networks (WSN) are mandatory tasks for providing secure data transmission. Attackers or intruders are rising with various types of network harming activities. Due to the open shared medium of WSN, the services can be easily broken. Intrusion Detection System (IDS) helps to keep the network secure against the attackers. At the same time, it is not sufficient against numerous real time attackers. There are plenty of attacks are injected in wireless transmissions. So, taking a deep survey and finding the needs in security perspective are very important jobs. This survey article analyses the problems and solutions given on secure routing and successful watchdog production in WSN. Collectively, this survey helps to understand IDS techniques, WSN characteristics, secure routing, key management techniques and watchdog construction strategies in detail. Finally, this article states some notable problems and solutions for providing optimal watchdog productions. This keeps WSN free from attackers and intruders. As watchdog is a light weight agent, the techniques and protocols used for intrusion detection shall not create maximum overhead and any runtime issues. In this regard, this work analyses various proactive and reactive routing protocols, light weight cryptography techniques and attack types. From the analysis, this deep survey suggests the optimal usage of secure routing protocols and hardware efficient security algorithms. This survey extends its contribution to reveal the adaptability of efficient cryptography techniques, attacks detection algorithms and protocols with real-time watchdogs. This work significantly contributes for watchdog based intrusion detection in low powered WSN. The performance comparisons and the results given in this work deliver the overall technical benefits and limitations of various techniques.