Traditional Intrusion Detection Systems Research Articles

Intrusion Detection System to Secure a Network using ACNN Model and Machine Learning

As cyber threats continue to evolve in sophistication and diversity, the need for robust Intrusion Detection Systems (IDS) becomes paramount to safeguarding network integrity. This research explores the application of an innovative approach by integrating an Attention-based Convolutional Neural Network (ACNN) model with machine learning techniques to enhance the accuracy and efficiency of intrusion detection. The proposed system leverages the ACNN's ability to capture contextual dependencies in network traffic data, enabling the extraction of intricate patterns indicative of potential intrusions. The ACNN's attention mechanism focuses on relevant features within the data, improving the model's discriminative power and adaptability to dynamic cyber threats. To achieve optimal performance, the ACNN is complemented with a machine learning framework that includes feature engineering, dimensionality reduction, and classification algorithms. This integrated approach allows the system to adapt and learn from evolving attack vectors, providing a proactive defense mechanism against both known and unknown threats. The research evaluates the proposed ACNN-based IDS using benchmark datasets and real-world network traffic scenarios. Comparative analysis against traditional IDS models showcases the superiority of the ACNN in terms of detection accuracy, false positive rates, and computational efficiency. Furthermore, the system's adaptability to emerging threats is demonstrated through continuous learning and retraining mechanisms. Results indicate that the ACNN-based IDS not only exhibits superior performance but also demonstrates resilience against evasion techniques employed by malicious actors. The research findings contribute to the advancement of network security by presenting a cuttingedge solution that combines deep learning and machine learning for effective and adaptive intrusion detection.

Reinventing Web Security: An Enhanced Cycle-Consistent Generative Adversarial Network Approach to Intrusion Detection

Web3.0, as the link between the physical and digital domains, faces increasing security threats due to its inherent complexity and openness. Traditional intrusion detection systems (IDSs) encounter formidable challenges in grappling with the multidimensional and nonlinear traffic data characteristic of the Web3.0 environment. Such challenges include insufficient samples of attack data, inadequate feature extraction, and resultant inaccuracies in model classification. Moreover, the scarcity of certain traffic data available for analysis by IDSs impedes the system’s capacity to document instances of malicious behavior. In response to these exigencies, this paper presents a novel approach to Web3.0 intrusion detection, predicated on the utilization of cycle-consistent generative adversarial networks (CycleGANs). Leveraging the data transformation capabilities of its generator, this method facilitates bidirectional conversion between normal Web3.0 behavioral data and potentially intrusive behavioral data. This transformative process not only augments the diversity and volume of recorded intrusive behaviors but also clandestinely simulates various attack scenarios. Furthermore, through fostering mutual competition and learning between the discriminator and generator, the approach enhances the ability to discern the defining characteristics of potential intrusive behaviors, thereby bolstering the accuracy of intrusion detection. To substantiate the efficacy of the CycleGAN-based intrusion detection method, simulation experiments were conducted utilizing public datasets, including KDD CUP 1999 (KDD), CIC-DDOS2019, CIC-IDS2018, and SR-BH 2020. The experimental findings evince the method’s remarkable accuracies across the four datasets, attaining rates of 99.81%, 97.79%, 89.25%, and 95.15%, respectively, while concurrently maintaining low false-positive rates. This research contributes novel insights and methodologies toward the advancement of Web3.0 intrusion detection through the application of CycleGAN technology, which is poised to play a pivotal role in fortifying the security landscape of Web3.0.

A Novel Architecture for an Intrusion Detection System Utilizing Cross-Check Filters for In-Vehicle Networks.

The Controller Area Network (CAN), widely used for vehicular communication, is vulnerable to multiple types of cyber-threats. Attackers can inject malicious messages into the CAN bus through various channels, including wireless methods, entertainment systems, and on-board diagnostic ports. Therefore, it is crucial to develop a reliable intrusion detection system (IDS) capable of effectively distinguishing between legitimate and malicious CAN messages. In this paper, we propose a novel IDS architecture aimed at enhancing the cybersecurity of CAN bus systems in vehicles. Various machine learning (ML) models have been widely used to address similar problems; however, although existing ML-based IDS are computationally efficient, they suffer from suboptimal detection performance. To mitigate this shortcoming, our architecture incorporates specially designed rule-based filters that cross-check outputs from the traditional ML-based IDS. These filters scrutinize message ID and payload data to precisely capture the unique characteristics of three distinct types of cyberattacks: DoS attacks, spoofing attacks, and fuzzy attacks. Experimental evidence demonstrates that the proposed architecture leads to a significant improvement in detection performance across all utilized ML models. Specifically, all ML-based IDS achieved an accuracy exceeding 99% for every type of attack. This achievement highlights the robustness and effectiveness of our proposed solution in detecting potential threats.

A multi-step attack path prediction method for oil & gas intelligence pipeline cyber physics system based on CPNE

Owing to the integration of the 5th Generation Mobile Communication Technology (5 G) and industrial internet construction, Oil & Gas intelligent pipeline network has witnessed accelerated construction and development. The Oil & Gas intelligent pipeline network proposed by China National Petroleum Corporation exhibits the advantages such as high integration, data unification, and intelligent decision-making, which helps to greatly reduce manual management costs, optimize risk decision-making by managers, and avoid risks such as human misuse. However, the highly integrated Cyber-physical system of the Internet and the Internet of Things faces various cyber security threats, and traditional intrusion detection systems exhibit drawbacks in the face of complex cyber-attack behaviors. In response to incomplete multi-step attack path prediction in traditional prediction methods, this paper proposes a multi-step attack path prediction method for Oil & Gas intelligence pipeline cyber physics system (CPS) based on Colored Petri nets and mixed strategy Nash equilibrium (CPNE). Taking into account the importance of assets and the dependency relationships between assets within the cyber-physical system of Oil & Gas intelligent pipeline network, CPNE constructs a node dependency model for the cyber-physical system of Oil & Gas intelligent pipeline network, simulates multi-step attack and defense games, calculates the probability of node failure triggering and transfer using mixed strategy Nash equilibrium, and extracts the risk of multi-step attack paths for different attack strategies. With the filtration and separation unit of a certain natural gas station as an example, this paper establishes a CPNE model to rank the risk of the first multi-step attack single attack source path and predict the risk of subsequent multi-step attack source paths, thus predicting multi-step attack paths. Taking three rounds of attacks as an example, compared to the paths predicted by traditional probability attack graph models, the proposed CPNE model is more advantageous in multi attack source path prediction, with a 2.33-fold increase in the relative coverage rate of path predictions.

Machine learning-based intrusion detection system for detecting web attacks

<p>The increasing use of smart devices results in a huge amount of data, which raises concerns about personal data, including health data and financial data. This data circulates on the network and can encounter network traffic at any time. This traffic can either be normal traffic or an intrusion created by hackers with the aim of injecting abnormal traffic into the network. Firewalls and traditional intrusion detection systems detect attacks based on signature patterns. However, this is not sufficient to detect advanced or unknown attacks. To detect different types of unknown attacks, the use of intelligent techniques is essential. In this paper, we analyse some machine learning techniques proposed in recent years. In this study, several classifications were made to detect anomalous behaviour in network traffic. The models were built and evaluated based on the Canadian Institute for Cybersecurity-intrusion detection systems dataset released in 2017 (CIC-IDS-2017), which includes both current and historical attacks. The experiments were conducted using decision tree, random forest, logistic regression, gaussian naïve bayes, adaptive boosting, and their ensemble approach. The models were evaluated using various evaluation metrics such as accuracy, precision, recall, F1-score, false positive rate, receiver operating characteristic curve, and calibration curve.</p>

Modified genetic algorithm and fine-tuned long short-term memory network for intrusion detection in the internet of things networks with edge capabilities

The emergence of smart cities is an example of how new technologies, such as the Internet of Things (IoT), have facilitated the creation of extensive interconnected and intelligent ecosystems. The widespread deployment of IoT devices has enabled the provision of constant environmental feedback, thereby facilitating the automated adaptation of associated systems. This has brought about a fundamental transformation in the way contemporary society functions. The security of emerging technologies such as IoT has become a significant challenge due to the added complexities, misconfigurations, and conflicts between modern and legacy systems. This challenge has a notable impact on the reliability and accessibility of existing infrastructure. Edge computing (EC) is a collaborative computing system that brings data processing and analysis closer to the edge of the network, where the data is generated, rather than in a centralized cloud environment. The utilization of the IoT has become more prevalent in both everyday life and the manufacturing sector, with a particular emphasis on critical infrastructure. The IoT is presently being utilized across diverse domains, including but not limited to industrial, agricultural, healthcare, and logistical sectors. The security of IoT networks has implications for the safety of individuals, the security of the nation, and economic development. Notwithstanding, conventional intrusion detection techniques that rely on centralized cloud-based systems that have been suggested in previous studies for IoT network security are insufficient to meet the requirements for data confidentiality, network capacity, and prompt responsiveness. In addition, the integration of IoT applications into smart devices has been shown to augment their functionalities. However, it is important to note that this integration also brings about potential security vulnerabilities. Furthermore, a significant number of contemporary IoT devices exhibit restricted security capabilities, rendering them vulnerable to intricate attacks and impeding the extensive integration of IoT technologies. Also, a lot of IoT network devices have been put in place that don't have hardware security measures. This means that traditional intrusion detection systems (IDS) aren't enough to protect the IoT network ecosystem. To address these issues, this research suggests the IoT-Defender framework, which combines a Modified Genetic Algorithm (MGA) model with a deep Long Short-Term Memory (LSTM) network to find cyberattacks in IoT networks. This research represents a pioneering attempt to employ the MGA for feature selection and the GA for fine-tuning the LSTM parameters within an EC framework. The parameters of the LSTM model were fine-tuned through the manipulation of the number of hidden layers, utilizing the GA fitness function. The customization of the MGA aimed to enhance its performance in selecting relevant features, optimizing the use of limited resources on IoT devices and edge nodes. The fine-tuning process involved optimizing hyperparameters, architecture, and training strategies to maximize the LSTM network's effectiveness in learning and detecting patterns in IoT network traffic. The synergy between the MGA and LSTM aimed at creating a comprehensive and efficient IDS. The feature selection by the MGA contributes to improving the LSTM’s performance by providing it with more relevant and discriminating features. In order to solve the issue of class imbalance, we utilize the focal loss function, which provides greater weights to minority classes, hence improving the model’s capacity to learn from those particular classes. The performance of the IoT-Defender model was assessed on the BoT-IoT, UNSW-NB15, and N-BaIoT datasets utilizing a Raspberry Pi IoT device. The results of our study show that the IoT-Defender model works better than other methods. This is shown by its accuracy score of 99.41%, detection rate of 99.78%, precision score of 98.50%, false alarm rate of 2.56%, mean intersection over union (mIoU) of 0.68, and training time of 81.3 seconds on BoT-IoT. The proposed IoT model is designed to be lightweight and can be installed on edge servers to detect cyber-attacks in real-time, specifically in the context of IoT security.

Intrusion Detection System based on Chaotic Opposition for IoT Network

The rapid advancement of network technologies and protocols has fueled the widespread endorsement of the Internet of Things (IoT) in numerous domains, including everyday life, healthcare, industries, agriculture, and more. However, this rapid growth has also given rise to numerous security concerns within IoT systems. Consequently, privacy and security have become paramount issues in the IoT framework. Due to the heterogeneous data produced by smart IoT devices, traditional intrusion detection system doesn't work well with IoT system. The massive volume of heterogeneous data has several irrelevant, redundant, and unnecessary features which lead to high computation time and low accuracy of IDS. Therefore, to tackle these challenges, this paper presents a novel metaheuristic-based IDS model for the IoT systems. The chaotic opposition-based Harris Hawk optimization (CO-IHHO) algorithm is used to perform the feature selection of data traffic. The chosen features are subsequently inputted into a machine learning (ML) classifier to detect network traffic intrusions. The performance of the CO-IHHO based IDS model is verified against the BoT-IoT dataset. Experimental findings reveal that CO-IHHO-DT achieves the maximal accuracy of 99.65% for multiclass classification and 100% for binary classification, and minimal computation time of 31.34 sec for multiclass classification and 133.54 sec for binary classification.

An Intelligent Security System Using Enhanced Anomaly-Based Detection Scheme

Abstract Ensuring the security of computer networks is of utmost importance, and intrusion detection plays a vital role in safeguarding these systems. Traditional intrusion detection systems (IDSs) often suffer from drawbacks like reliance on outdated rules and centralized architectures, limiting their performance in the face of evolving threats and large-scale data networks. To address these challenges, we present an advanced anomaly detection-based IDS that utilizes a decentralized communicative multi-agent reinforcement learning (MARL). In our approach, multiple reinforcement learning agents collaborate in intrusion detection, effectively mitigating the non-stationarity problem and introducing a specialized secure communication method. We further enhance the learning process by incorporating external knowledge. Our approach is evaluated through extensive experiments conducted on the benchmark NSL Knowledge Discovery and Data Mining dataset. These experiments encompass diverse scenarios, involving varying numbers of agents to prove scalability feature. The results underscore the effectiveness of our method, which surpasses the performance of existing state-of-the-art solutions based on MARL, achieving a high accuracy rate of 97.80%.

Secure and privacy-preserving intrusion detection in wireless sensor networks: Federated learning with SCNN-Bi-LSTM for enhanced reliability

As the digital landscape expands rapidly due to technological advancements, cybersecurity concerns have become more prevalent. Intrusion Detection Systems (IDSs), which are crucial for identifying unusual network traffic indicative of malicious activity, have become a necessity. These systems can be either hardware or software-based. However, traditional IDS models often fail to adequately protect data privacy and detect complex, unique breaches, particularly within Wireless Sensor Networks (WSNs). To address these limitations, this paper proposes a novel Stacked Convolutional Neural Network and Bidirectional Long Short Term Memory (SCNN-Bi-LSTM) model for intrusion detection in WSNs. This model leverages Federated Learning (FL) to enhance intrusion detection performance and safeguard privacy. The FL-based SCNN-Bi-LSTM model is unique in its approach, allowing multiple sensor nodes to collaboratively train a central global model without revealing private data, thereby alleviating privacy concerns. The deep learning methodology of the SCNN-Bi-LSTM model effectively identifies sophisticated and previously unknown cyber threats by meticulously examining both local and temporal linkages in network patterns. The model has been specifically designed to detect and categorize different types of Denial of Service (DoS) attacks using specialized WSN-DS and CIC-IDS-2017 datasets. Compared to traditional Artificial Deep Neural Network (ADNN) models, our proposed FL-SCNN-Bi-LSTM model demonstrated superior detection rates for complex and unknown attacks, significantly improving IDS performance. The model achieved a notable classification accuracy of approximately 99.9% precision and recall on both datasets, substantially reducing false positives and negatives. Our research underscores the potential of federated learning and deep learning in enhancing the security and privacy of WSNs. The proposed FL-SCNN-Bi-LSTM architecture not only facilitates the identification of complex cyber threats but also exemplifies how deep learning techniques can be employed to bolster intrusion detection systems while preserving user data privacy.

Intrusion Detection in Internet of Things Systems: A Feature Extraction with Naive Bayes Classifier Approach

The Internet of Things (IoT) has proliferated, transitioning from modest home automation to encompass sectors like healthcare, agriculture, transportation, and manufacturing. This evolution is characterized by devices' ability to autonomously gather, disseminate, and analyze data, leading to improved real-time decision-making, predictive insights, and customized user experiences. The ubiquity of IoT, while promising, introduces significant data security concerns. The vast number of interlinked devices and diverse and often insufficient security features make them vulnerable to cyber threats, emphasizing the need for robust security mechanisms. Intrusion Detection Systems (IDS) have traditionally acted as vital guards against such threats; however, with the ever-increasing data in the IoT, traditional IDS models, such as Naive Bayes, face processing speed and accuracy challenges. This paper introduces a novel model, "FE+NB," which merges advanced Feature Extraction (FE) with the Naive Bayes (NB) classifier. Central to this model is the "Temporal-Structural Synthesis" technique tailored for IoT traffic data, focusing on data compression, temporal and structural analyses, and Feature Selection (FS) using mutual information. Consequently, the model enhances efficiency and accuracy in Intrusion Detection (ID) in complex IoT networks.

Development of a neural network structure for recognition of attacks in computer systems

The integration of industrial control communication networks and the Internet into the Industrial Control System (ICS) increases their vulnerability to cyber-attacks, leading to devastating consequences. Traditional intrusion detection systems (IDS) mostly rely on predefined models and are trained mostly on specific cyber attacks, which means that traditional IDS cannot deal with unknown attacks In addition, most IDSs do not take into account the imbalance of ICS datasets, and therefore suffer from low accuracy and high false positives when used. In the article, we propose an NCO-double-layer DIFF_RF-OPFYTHON intrusion detection method for ICS, which consists of NCO modules, two-layer DIFF_RF modules, and OPFYTHON modules. Detected traffic will be divided into three categories by the two-layer DIFF_RF module: known attacks, unknown attacks, and normal traffic. Next, the known attacks will be classified by the OPFYTHON module into specific attacks according to the characteristics of the attack traffic. We use the NCO module to improve model inputs and improve model accuracy. The results show that the proposed method outperforms traditional intrusion detection methods such as XGboost and SVM. Detecting unknown attacks is also significant. The accuracy of the data set used in this article reaches 98.13%. The detection rate of unknown and known attacks reaches 98.21% and 95.1%, respectively. In this article, the basic modules of the classifier are shallow machine learning algorithms. This can be improved by using a more powerful neural network architecture. In the article, all detected unknown attacks are marked as one category. In further studies, the unknown attacks can be clustered and analyzed to further classify the detected unknown attacks. It is worth noting that the number of unknown attacks is only a small part, so it is difficult to classify unknown attacks using cluster analysis. Since training a more powerful neural network requires a lot of data, it is important to investigate how to train a new model when the number of samples belonging to that class is limited.

Enhancing Intrusion Detection with Autoencoder Based Classifier and Statistical Feature Selection

In today's digital landscape, the rapid expansion of computer networks and the increasing reliance on information technology have made network security a paramount concern. With the growing sophistication of cyber threats, traditional intrusion detection systems (IDS) face significant challenges in effectively identifying and mitigating security breaches. To address these evolving threats, novel approaches that combine cutting-edge technologies are required. This paper explores the fusion of autoencoder based classifier to training and classifying the attacks of IDS. This approach is applied on the most meaningful feature that selected based on the pearson correlation (for continues vales) and chi-square test (for binary values). The benchmark NSL-KDD database is utilized to assess the validity of the suggested IDS. The experimental outcomes demonstrate that the designed Intrusion Detection System (IDS) attains superior classification accuracy at 92.27%, outperforming both prior research efforts and alternative classifier methods.

Adversarial Defense: A GAN-IF Based Cyber-security Model for Intrusion Detection in Software Piracy

Software-piracy continues to be most critical distress, posing grave threats to digital-assets and financial stability. Traditional Intrusion Detection systems (IDS) often battles hard to identify latest piracy attempts owing to their dependence on pre-established patterns. To effectively address this we attempt to suggest innovative approach leveraging DL based Generative Adversarial Networks (GANs) and ML based Isolation Forest (IF) for detecting software piracies. Our proposed GAN-IF based cyber-security model performs its functions by training a Generator network to mimic the behavior of genuine software applications. Discriminator network discriminates between legitimate and pirated software. Isolation Forests assists in detecting anomalies in diverse conditions, including unseen attacks. Integrated training based on DL and ML framework enables efficient learning and adaptation with respect to piracy challenges, making it highly-successful against prior known threats. There are several DL models which are utilized in IDS operations having limitations in terms of robustness, interpretability. Utilizing GAN in the context of cyber-security to combat software-piracy can have noteworthy merits since GANs can precisely identify forged software as they are skilled at generating fake content resembling actual. Training a GAN on legitimate software, helps to learn and identify disparities in pirated versions. Isolation-Forest can detect anomalies in software distribution networks or user behavior with respect to software usage by recognizing abnormal patterns indicating software piracy, like illegal access or sharing of software licenses. Our proposed model combines GANs and Isolation Forests, excels at accurately detecting subtle indicators of software piracy, a capability that traditional methods may fail to recognize. ML-DL integrated model continuously learns and updates its detection capabilities in response to evolving piracy tactics, making it resilient against zero-day attacks, polymorphic malware. Through adversarial training, ml-model minimizes false alarms and focuses only on genuine threats. In our evaluation, we demonstrate the effectiveness of GAN-IF based cyber-security model in detecting software piracy attempts across various scenarios. Results indicate that our approach outperforms traditional solutions in terms of detection accuracy and adaptability.

ILIDViz: An Incremental Learning-Based Visual Analysis System for Network Anomaly Detection

BackgroundWith the development of information technology, network traffic logs mixed with various kinds of cyber-attacks have grown explosively. Traditional intrusion detection systems (IDS) have limited ability to discover new inconstant patterns and identify malicious traffic traces in real-time. It is urgent to implement more effective intrusion detection technologies to protect computer security. MethodsIn this paper, we design a hybrid IDS, combining our incremental learning model (KAN-SOINN) and active learning, to learn new log patterns and detect various network anomalies in real-time. Results & ConclusionsThe experimental results on the NSLKDD dataset show that the KAN-SOINN can be improved continuously and detect malicious logs more effectively. Meanwhile, the comparative experiments prove that using a hybrid query strategy in active learning can improve the model learning efficiency.

Convolutional neural network for intrusion detection using blockchain technology

Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.

Designing accurate lightweight intrusion detection systems for IoT networks using fine-tuned linear SVM and feature selectors

Intrusion detection systems (IDSs) play a crucial role in ensuring the security and integrity of Internet of Things (IoT) networks by blocking unwanted packets and facilitating secure traffic flow. However, traditional IDSs based on data mining, fuzzy logic, heuristics, rough sets, or conventional machine learning (ML) techniques often lack accuracy and are not energy efficient, primarily due to inappropriate feature selection or the use of all features in datasets. To address these challenges, this study proposes a lightweight, accurate, and high-performance IDSs for IoT networks using fine-tuned Linear Support Vector Machines (LSVMs) and feature selection methods. Four feature selectors, including Importance Coefficient-, Forward- and Backward-Sequential-, and Correlation Coefficient-based approaches, were applied to identify the most important and efficient features from three datasets: KDD Cup-1999, BotIoT-2018, and N-BaIoT-2021. The fine-tuned LSVMs algorithm was then trained on subsets of the selected and full features of the datasets to detect various IoT botnet attacks. Evaluation results show that the IDS models trained with subsets of relevant features outperform those trained with the full feature sets of the datasets in terms of training and test performance and accuracy. The study concludes that it is possible to develop lightweight IDSs by training them with a reduced number of features (6) instead of using the full features (40, 15, 115) in KDD Cup-1999, BotIoT-2018, and N-BaIoT-2021, respectively. The findings highlight a potential for significantly improving the efficiency and accuracy of IDSs on IoT networks using the fine-tuned feature selectors and LSVMs.

Research on data imbalance in intrusion detection using CGAN.

To address the problems of attack category omission and poor generalization ability of traditional Intrusion Detection System (IDS) when processing unbalanced input data, an intrusion detection strategy based on conditional Generative Adversarial Networks (cGAN) is proposed. The cGAN generates attack samples that approximately obey the distribution pattern of input data and are randomly distributed within a certain bounded interval, which can avoid the redundancy caused by mechanical data widening. The experimental results show that the strategy has better performance indexes and stronger generalization ability in overall performance, which can solve insufficient classification performance and detection omission caused by unbalanced distribution of data categories and quantities.

A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications

The fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-related attacks are growing rapidly. There are a variety of different attacks including remote-to-user (R2L), user-to-remote (U2R), denial of service (DoS), distributed DDoS, and probing. Firewalls, antivirus scanners, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are widely used to prevent and stop cyber-related attacks. Especially, IDPSs are used to stop and prevent intrusions on communication networks. However, traditional IDSs are no longer effective in detecting complicated cyber attacks from normal network traffic. Because of this, new promising techniques, which specifically utilize data mining, machine learning, and deep learning, need to be proposed in order to distinguish intrusions from normal network traffic. To effectively recognize intrusions, the feature generation, feature selection, and learning processes must be performed delicately before the classification stage. In this study, a new feature selection method called FSAP (Feature Selection Approach) is proposed. In addition, a hybrid attack detection model called SABADT (Signature- and Anomaly-Based Attack Detection Technique) is suggested, which utilizes different classification metrics to recognize attacks. The proposed general method FSACM (Feature Selection and Attack Classification Method) is tested on KDD ’99, UNSW-NB15, and CIC-IDS2017 datasets. According to the experiment results, the proposed method outperformed the state-of-the-art methods in the literature in terms of detection, accuracy, and false-alarm rates.

Configuring and Implementing IPS Solutions for IoT Devices using NST

The necessity to ensure that Internet of Things (IoT) networks are secure is one of the biggest issues that has arisen as a result of the growing demand for technology that uses the IoT. Considering how many gadgets are linked to the internet, safeguarding their networks is a growing worry. Due to the IoT's network's complexity and resource constraints, traditional intrusion detection systems encounter a number of problems. The main objectives of this project are to design, develop, and evaluate a hybrid level placement method for an IDS based on multi- agent systems, BC technology (Block-Chain), and DL algorithms (Deep Learning). The breakdown of data administration, data collection, analysis, and reaction into its component parts reveals the overall system design. The National Security Laboratory's knowledge discovery and data mining dataset is used to test the system as part of the validation procedure. These results demonstrate how deep learning algorithms are effective at identifying risks at the network and transport levels. The experiment shows that deep learning techniques function well when used to find intrusions in a network environment for the Internet of Things.

Stochastic gradient descent classifier-based lightweight intrusion detection systems using the efficient feature subsets of datasets

The Internet of Things (IoT) has become an essential part of our daily lives. However, with the increasing use of IoT, the number of botnet attacks targeting resource-constrained IoT devices is also on the rise. To mitigate these threats, intrusion detection systems (IDSs) have been developed. However, traditional IDSs based on heavyweight deep/machine learning, fuzzy logic, rough set theories, or data mining techniques, often lack in detection accuracy and energy efficiency. Therefore, there is a crucial need for more lightweight, accurate, and energy-efficient IDSs capable of detecting a broad spectrum of cyber attacks. This paper presents a solution to these challenges by introducing lightweight and accurate IDSs that use a stochastic gradient descent classifier (SGDC) and four feature-selection algorithms based on a ridge regressor. The hyperparameters of the SGDC algorithm and ridge regressor model were fine-tuned to enhance the accuracy of IDSs while reducing computational complexity. Moreover, the fine-tuned feature selectors were used to decrease the dataset’s dimensionality and improve the accuracy of IDSs. To evaluate the proposed IDSs, three network traffic datasets (KDD-CUP-1999, BotIoT-2018, and N-BaIoT-2021) were used. The systems achieved an average accuracy of 92.69%, and the number of features was reduced by an average of 79.93%. The results demonstrate that the proposed systems can be utilized for lightweight IDSs on resource-constrained IoT devices. Overall, this paper presents a significant contribution to the field of IDSs for IoT devices by offering an efficient and accurate solution. The proposed lightweight IDSs have the potential to enhance IoT security and privacy, safeguarding sensitive IoT data.