Types Of Intrusion Detection Systems Research Articles

Network Intrusion Detection and Anomaly Classification

A software application known as an intrusion detection system (IDS) is utilized to monitor networks for any unauthorized or malicious activities that may violate security policies related to system confidentiality, integrity, and availability. Our thesis involved conducting extensive literature reviews on various types of IDS, anomaly detection methods, and machine learning algorithms that can be utilized for detection and classification. IDS are crucial for safeguarding advanced communication networks and were initially designed to identify specific patterns, signatures, and rule violations. In recent years, machine learning and deep learning approaches have been employed in the field of network intrusion detection, providing promising alternatives. Our proposed system involved identifying noisy features through causal intervention, preserving only those features that had a causality with cyberattacks. The ML algorithm was then utilized to make a preliminary classification to select the most relevant types of cyberattacks, ultimately leading to the detection of unique labeled cyberattacks through the counterfactual detection algorithm. Keywords—Intrusion Detection System (IDS), anomaly detection, machine learning algorithms, deep learning, causal intervention, cyberattack classification, and counterfactual detection.

Laser-Enabled Intruder Detection System

Laser-enabled intruder detection systems (LIDs) are a type of intrusion detection system (IDS) that utilizes laser beams to detect the presence of intruders in a protected area. LIDs can be used to protect a wide variety of assets, including homes, businesses, and government facilities. They are particularly effective in areas where traditional security measures, such as motion sensors and cameras, are not feasible or effective. LIDs work by creating a virtual barrier around a protected area. When an intruder breaks this barrier, the laser beam is interrupted, and an alarm is triggered. LIDs can be customized to detect a wide variety of intruders, including humans, animals, and vehicles. They can also be configured to detect intruders at a variety of distances, from a few feet to several hundred feet. LIDs are a relatively new technology, but they have already been proven to be an effective way to deter and detect intruders. They are becoming increasingly popular as a security measure for both residential and commercial properties.

Analysis of a Fuzzy Based Intrusion Detection System in Wireless Ad Hoc Networks

Technology and its growth is considerably enormous. This massive growth allows the opening of new fields of application in the domain of wireless networking and mobile ad-hoc networks (MANET) is one of its kinds. Mobile ad hoc network is widely used from collaborative computing to time critical applications in indoor and outdoor environment. Mobility of ad hoc network makes very attractive in all areas of mobile applications. Nodes participating in mobile ad hoc networks are autonomous, self-configurable and act as a router as well. These types of networks are dynamic in nature and have sort life time. Dynamic nature and limitations of the wireless transmission medium make MANET unsecured and vulnerable to various attacks. It is very tough to implement security for this networks and it opens up doors for further research work on this area. There is a great scope for designing a system to identify attacks and take countermeasures to minimize it and keep the performance of the network within acceptable limits. Intrusion detection system is one of its kinds and considered as security mechanism for MANET. This thesis explores different types of intrusion detection system like misuse detection and anomaly detection for mobile ad hoc networks. Anomaly detection techniques for ad hoc networks depend on the characterization of normal behavior pattern of wireless nodes. This research work focuses on wireless node behavior based detection technique. Most of anomaly intrusion detection systems are focusing on upper layer traffic to a profile normal behavior of wireless node. This research work focus on media access control (MAC) layer and network layer of wireless node. It is inefficient to use a large feature set of MAC layer and network layer due to energy limitation in ad-hoc network. A minimal feature set from MAC layer and network layer were proposed. This research work proposed an anomaly intrusion detection system for mobile ad hoc network using fuzzy logic and weighted average method. The network performance of mobile ad hoc network with intrusion detection system was analyzed using various network parameters. Further the performance of the performance of the intrusion detection system was analyzed using detection rate and false alarms. Results show good improvement in detection rate and other performance metrics

A Hybrid Intrusion Detection Approach for Cyber Attacks

The field of cybersecurity constantly evolves as attackers develop new methods and technologies. Defending against cyberattacks involves a combination of robust security measures, regular updates, user education, and the use of advanced technologies, such as intrusion detection systems and artificial intelligence, to find out the threats in real-time. IDS are designed to identify and address any unauthorized actions or potential security threats within a computer network or system. A hybrid intrusion detection system (IDS) combines many detection techniques and strategies from different IDS types into a single, coherent solution. Combining the benefits of each approach should result in more comprehensive and effective intrusion detection. This paper outlines a proposed anomaly intrusion detection system (AIDS) framework that leverages a hybrid of deep learning strategies. It incorporates Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models, which were developed using XGBoost, and their efficacy was assessed with the NSL-KDD dataset. The evaluation of the suggested model focused on its accuracy, detection capabilities, and the rate of false positives. The outcomes of this research are noteworthy within the cybersecurity field. In this paper, a framework of an Anomaly IDS is proposed. The purpose of an anomaly IDS, or AIDS, is to spot odd behavior on a network or system that might point to a security breach or malevolent attempt to hack it. Anomaly-based IDSs concentrate on finding departures from accepted typical behavior, in contrast to signature-based detection systems, which depend on a predefined database of known attack patterns.

Multi head self-attention gated graph convolutional network based multi‑attack intrusion detection in MANET

Designing of intrusion detection system (IDS), and mobile ad hoc networks (MANET) prevention technique with examined detection rate, memory consumption with minimum overhead are vital concerns. Node mobility and node energy are the two optimization problems in MANETs wherein nodes travel uncertainly in any direction, evolving in a continuous change of topology. With the proposed approach, a Centrality Coati Optimization Algorithm based Cluster Gradient for multi attack intrusion identification is devised. This study focuses on the problems of node mobility and energy to develop a clustering algorithm for cluster head selection in MANET that is incited by Dual Network Centrality. Compact cluster formation is carried out by Coati Optimization Algorithm (COA). The Multi-head Self-Attention based Gated Graph Convolutional Network (MSA-GCNN) with a hybrid type of IDS recognizes several attacks, including DoS and Zero-Day attacks. The proposed technique is implemented in NS-2 network simulator. The performance of proposed approach is examined under some parameters, like attack detection rate, memory consumption, computational time for detecting the intruder. The outcomes display that the proposed technique decreases the IDS traffic and entire consumption of memory and sustains a higher attack identification rate with less computational time. The proposed technique attains 4.299 %, 10.375 % and 6.935 % Accuracy, 5.262 %, 8.375 % and 7.945 % Precision, 7.282 %, 10.365 % and 5.935 % Recall, 9.272 %, 5.355 % and 8.965 % ROC is higher compared with the existing methods such as, Epsilon Swarm Optimized Cluster Gradient along deep belief classifier for multiple attack intrusion detection (ESOC-MA-ID-MANET), Intrusion Detection secure solution for intrusion detection in cloud computing utilizing hybrid deep learning approach called EOS-IDS and improved heap optimization (IHO-MA-ID-MANET) for induction detection technique respectively.

Dynamic Inertia Weight Particle Swarm Optimization for Anomaly Detection: A Case of Precision Irrigation

Anomaly-based Intrusion Detection System (IDS) is a type of IDS that detects abnormal behaviors by analyzing system activity and network traffic. Anomaly-based IDS works by establishing a baseline of normal behavior for a system or a network. However, these types of systems are less used compared to signature-based IDS for one primary challenge: How to define this normal behavior baseline? The answer to this question is complicated, since it involves not only analyzing or learning from historical data, but requires and understanding of the business domain the system is implemented in. The present study proposes a novel approach to constructing an unsupervised data classifier that combines both Particle Swarm Optimization (PSO) and clustering techniques for anomaly detection. The primary objective of this methodology is to surmount the limitations that conventional clustering algorithms suffer from, such as their inability to identify non-linear patterns within the data, susceptibility to initial conditions, and difficulty in overcoming the problem of local optima. The concept of particle systems is discussed by examining their origins, search strategies, and convergence mechanisms. We use a variant of the Particle Swarm Optimization called Dynamic Inertia Weight-Particle Swarm optimization (DIW-PSO) for our clustering process, and we elaborate on the reasoning behind this decision. Subsequently, we describe the labeling algorithm used for the resulting clusters and we explain the process for identifying anomalous clusters. We have demonstrated the effectiveness of our method by applying it to an intelligent irrigation control system for cotton plants. The results show that our classifier was able to accurately detect abnormal patterns that deviated from the optimal water requirements and growth conditions of the plants.

An Intelligent Machine Learning based Intrusion Detection System (IDS) for Smart cities networks

INTRODUCTION: Internet of Things (IoT) along with Cloud based systems are opening a new domain of development. They have several applications from smart homes, Smart farming, Smart cities, smart grid etc. Due to IoT sensors operating in such close proximity to humans and critical infrastructure, there arises privacy and security issues. Securing an IoT network is very essential and is a hot research topic. Different types of Intrusion Detection Systems (IDS) have been developed to detect and prevent an unauthorized intrusion into the network.OBJECTIVES: The paper presents a Machine Learning based light, fast and reliable Intrusion Detection System (IDS).METHODS: Multiple Supervised machine learning algorithms are applied and their results are compared. Algorithms applied include Linear Discriminant analysis, Quadratic Discriminant Analysis, XG Boost, KNN and Decision Tree.RESULTS: Simulation results showed that KNN Algorithm gives us the highest accuracy, followed by XG Boost and Decision Tree which are not far behind.CONCLUSION: A fast, secure and intelligent IDS is developed using machine learning algorithms. The resulting IDS can be used in various types of networks especially in IoT based networks.

AIDTF: Adversarial training framework for network intrusion detection

Network Intrusion Detection Systems (IDS) have achieved high accuracy by widely applying Machine Learning (ML) models. However, most current ML-based IDSs can not cope with targeted attacks from adversaries because they are commonly trained and tested using fixed data sets. In this paper, we propose an Adversarial Intrusion Detection Training Framework (AIDTF) to improve the robustness of IDSs, which consists of an attacker model a-model, a defender model d-model, and a black-box trainer t-module. Both the a-model and d-model are multilayer perceptrons, and the t-module is the module used to train IDSs. AIDTF improves the accuracy of IDS by using an adversarial training method, which is different from traditional training methods. Taking the distribution of normal samples in the dataset as the distribution that the a-model and d-model need to learn, the goal of the a-model is to generate samples that deceive the d-model, while the goal of the d-model is to determine whether the input samples are real samples, so there is an adversarial relationship between a-model and d-model. Different types of IDSs can be trained by the t-module using the samples generated from the confrontation between the a-model and the d-model, and we call this kind of IDS the Adversarial Training Intrusion Detection System (ATIDS). The main contribution of this paper is to propose a training method that is used to obtain an IDS with high accuracy not only for known test sets but also to identify unknown disguised attack samples. We tested different types of ATIDSs using the current mainstream attack methods, which include the Fast Gradient Method, Fast Gradient Sign Method, Projected Gradient Descent, and Jacobs Saliency Map Algorithm. The experimental results prove that AIDTF outperforms other adversarial training methods with not only higher accuracy for the test set but also up to a 99% recognition rate for the attack samples.

Analysis on Intrusion Detection Systems to Secure IoT Networks

The amalgamation of physical objects and the internet constitutes the Internet of things(IoT). In the subsequent times, more such physical objects will be connected to the internet and this will lead to the escalation in the attacks carried out on IoT devices and network. This is mainly due to the less memory and lack in built-in security controls. This has made IoT Security, the most researched topic in the past decade. Thus to protect IoT nodes and networks, a security mechanism called Intrusion Detection System(IDS) is brought in use.The advent of Internet of things has played a crucial role in making the lives of the people more easier and comfortable. It has improved the lives of the people in terms of several aspects like comfort and efficiency. This has overall consequently lead to what is called smart environments. When the case of real world smart environment is discussed, both security and privacy comes into play in being the key issues to be considered. But the need demands for the Intrusion Detection Systems (IDSs) to be designed for the IoT networks or environments to mitigate attack related issues. These are the attacks that exploits the vulnerabilities present in the network. The work here demonstrates the need of the fact that despite having previous technologies, we still lack a secure system that could safeguard IoT networks. In this paper, a detailed analysis is provided on IoT, security attacks in IoT, IDS, types of IDS, Machine learning and Deep learning techniques and algorithms used with IDS in IoT and current trends and research on use of IDS in securing Internet of Things is discussed. Lastly future research based on the current analysis is also examined. Keywords: IoT, IDS, Network, Security, Machine Learning, Deep Learning

SOME/IP Intrusion Detection System Using Machine Learning

With the development of in-vehicle network technologies, Automotive Ethernet is being applied to modern vehicles. Scalable service-Oriented MiddlewarE over IP (SOME/IP) is an automotive middleware solution that is used for communications of the infotainment domain as well as that of other domains in the vehicle. However, since SOME/IP lacks security, it is vulnerable to a variety of network-based attacks. In this paper, we introduce a new type of intrusion detection system (IDS) leveraging on SOME/IP packet's header information and packet reception time to deal with SOME/IP related network attacks.

Intrusion Detection System-Based Security Mechanism for Vehicular Ad-Hoc Networks for Industrial IoT

Security is an absolutely crucial aspect of any Industrial Internet of Things (IIoT) network that must be considered carefully to protect users while allowing for proper, error-free functioning of the entire network. Vehicular ad-hoc networks (VANETs) are a type of network that has emerged with the aim of strengthening the available intelligent transportation systems. Enhancing overall security in VANETs should be a top priority as problems in these networks can put lives at risk. Various security frameworks and solutions including the use of intrusion detection systems (IDS) have been proposed in the literature by researchers across the globe. In this study, the various challenges and problems associated with IDS usage in VANETs are thoroughly examined. In order to enhance the detection capabilities of IDS such that they can detect both existing and zero-day unknown attacks, we present a novel approach that makes use of honeypots in addition to conventional IDS to improve VANET security. We believe our honeypot-based IDS solution for VANETs will prove itself by enhancing overall detection rates while consuming fewer resources. Various design considerations like the optimal number of honeypot nodes, deployment locations of those nodes, type of IDS to be used, etc., are discussed herein. The main objective behind this study is to explore the various types of IDS already being used in VANETs for intrusion detection as well as to understand the challenges and benefits each approach offers, we hope that this work will become a valuable resource for researchers working in this field in the future.

Intelligent IDS: Venus Fly-Trap Optimization with Honeypot Approach for Intrusion Detection and Prevention

Intrusion Detection Systems and Intrusion Prevention Systems are used to detect and prevent attacks/malware from entering the network/system. Honeypot is a type of Intrusion Detection System which is used to find the intruder, study the intruder and prevent the intruder to access the original system. It is necessary to build a strong honeypot because if it is compromised, the original system can be easily targeted by the attacker. To overcome such challenges an efficient honeypot is needed that can shut the attacker after extracting his attack technique and tools. In this paper, a Venus fly-trap optimization algorithm has been used for implementing the honeypot system along with Intrusion Detection System. Venus plants are a type of carnivorous plants that catch their prey intelligently. By adopting this feature we make an effective honeypot system that will intelligently interact with the attacker. A new fitness function has been proposed to identify size of the attacker. The effectiveness of the proposed fitness function has been evaluated by comparing it with state of the art. For comparison, remote-to-local attacks, probing attacks and DOS attacks are performed on both proposed and existing models. The proposed model is significant to catch/block all the intruders which were caught by the art and also the proposed model reduces the time of interaction between the attacker and honeypot system thereby giving minimum information to the attacker.

A Survey on Wireless Network Intrusion Detection

Artificial Intelligence (AI) discoveries have intensified in recent years as a result of the industry’s widespread adoption of this technology. The important field of AI is neural networks, that allow commercial usage of capabilities that were previously unattainable through computer use. One of the domains in which neural network is widely studied for increasing general security and data privacy is IDS. Using various machine learning approaches, this article provides a complete review of recent research on neural network topologies and types of intrusion detection systems.

Multiclass cyber-attack classification approach based on the Krill Herd Optimized Deep Neural Network (KH-DNN) model for WSN

The Intrusion Detection System (IDS) is a useful infiltration detection tool. With IDS, it may mechanically categorize intrusions, attacks, or breaches of security stratagems across host-level within the network and within the organization. The Krill Herd Optimized Deep Neural Network (KH-DNN) is proposed in this document as a multiclass cyberattack methodology. This model is suggested by uniting the network-based intrusion detection system (NIDS) and the host-based intrusion detection system (HIDS) to advance flexible and actual IDS to categorize and detect unexpected and unpredictable cyber attacks. In this method, two types of IDS are classified, that is, NIDS and HIDS. Classification of the system call is exploited to discriminate behavior into normal and attack categories. In this manuscript accuracy, the parameter of the deep neural network classifier is optimized with the Krill Herd optimization algorithm. Finally, the DNN model is performed in the NIDS dataset and the HIDS dataset. For the HIDS dataset, the KDD Cup 99 dataset was used, which employed two datasets: ADFA-LD and ADFA-WD, and several types of attacks were detected and classified, including Adduser, Hydra-FTP, Java-Meterpreter, Hydra-SSH, and Web-Shell. The suggested IDS-KH-DNN algorithm attains higher accuracy 42.56% and 23.4%, high precision 84.74% and 52.43%, high F-score 53.5% 64.455, high sensitivity 33.4% and 45.23%, and high specificity 31.45% and 44.23% for the NIDS dataset. The proposed system is compared to two current processes: intrusion detection using Gray Wolf optimization-based support vector machine (IDS-GWO-SVM) and intrusion detection using artificial bee colony optimization algorithm based support vector machine (IDS-ABCO-SVM). Finally, the simulation results show that the suggested approach is capable of quickly and accurately locating optimal solutions.

An Analysis of Intrusion Detection Classification using Supervised Machine Learning Algorithms on NSL-KDD Dataset

From the past few years, Intrusion Detection Systems (IDS) are employed as a second line of defence and have shown to be a useful tool for enhancing security by detecting suspicious activity. Anomaly based intrusion detection is a type of intrusion detection system that identifies anomalies. Conventional IDS are less accurate in detecting anomalies because of the decision taking based on rules. The IDS with machine learning method improves the detection accuracy of the security attacks. To this end, this paper studies the classification analysis of intrusion detection using various supervised learning algorithms such as SVM, Naive Bayes, KNN, Random Forest, Logistic Regression and Decision tree on the NSL-KDD dataset. The findings reveal which method performed better in terms of accuracy and running time.

Statistical Analysis of Different Artificial Intelligent Techniques applied to Intrusion Detection System

Intrusion detection is the act of detecting unwanted traffic on a network or a device. Several types of Intrusion Detection Systems (IDS) technologies exist due to the variance of network configurations. Each type has advantages and disadvantage in detection, configuration, and cost. In general, the traditional IDS relies on the extensive knowledge of security experts, in particular, on their familiarity with the computer system to be protected. To reduce this dependence, various datamining and machine learning techniques have been used in the literature. The experiments and evaluations of the proposed intrusion detection system are performed with the NSL-KDD intrusion detection dataset. We will apply different learning algorithms on NSL-KDD data set, to recognize between normal and attack connections and compare their performing in different scenariosdiscretization, features selections and algorithm method for classification- using a powerful statistical analysis: ANOVA. In this study, both the accuracy of the configuration of different system and methodologies used, and also the computational time and complexity of the methodologies are analyzed.

A novel hybrid-based approach of snort automatic rule generator and security event correlation (SARG-SEC).

The rapid advanced technological development alongside the Internet with its cutting-edge applications has positively impacted human society in many aspects. Nevertheless, it equally comes with the escalating privacy and critical cybersecurity concerns that can lead to catastrophic consequences, such as overwhelming the current network security frameworks. Consequently, both the industry and academia have been tirelessly harnessing various approaches to design, implement and deploy intrusion detection systems (IDSs) with event correlation frameworks to help mitigate some of these contemporary challenges. There are two common types of IDS: signature and anomaly-based IDS. Signature-based IDS, specifically, Snort works on the concepts of rules. However, the conventional way of creating Snort rules can be very costly and error-prone. Also, the massively generated alerts from heterogeneous anomaly-based IDSs is a significant research challenge yet to be addressed. Therefore, this paper proposed a novel Snort Automatic Rule Generator (SARG) that exploits the network packet contents to automatically generate efficient and reliable Snort rules with less human intervention. Furthermore, we evaluated the effectiveness and reliability of the generated Snort rules, which produced promising results. In addition, this paper proposed a novel Security Event Correlator (SEC) that effectively accepts raw events (alerts) without prior knowledge and produces a much more manageable set of alerts for easy analysis and interpretation. As a result, alleviating the massive false alarm rate (FAR) challenges of existing IDSs. Lastly, we have performed a series of experiments to test the proposed systems. It is evident from the experimental results that SARG-SEC has demonstrated impressive performance and could significantly mitigate the existing challenges of dealing with the vast generated alerts and the labor-intensive creation of Snort rules.

Intrusion Detection System Techniques : A Review

Nowadays, Internet attacks are increasing rapidly. As a result, information security is a serious global concern among Information Technology users. Intrusion Detection System (IDS) is capable to detect unauthorized intrusions into computer systems and networks by looking for signatures of known attacks or deviations of normal activity. IDS is such as a detective control, the main function is to warn the user of any suspicious activity taking place. Active IDS research are still ongoing with remarkable techniques to detect attacks with significance accurate result. This paper deliver a brief overview on types of IDS and a types of techniques employed to detect intrusion.

A novel context-aware feature extraction method for convolutional neural network-based intrusion detection systems

To create a safe and secure cyberspace, many researchers have created and proposed Intrusion Detection Systems (IDSs). Different types of IDSs are either designed to address only a single kind of intrusion or multiple variants. In this paper, we proposed a new context-aware feature extraction method as a pre-processing step for Convolutional Neural Network (CNN)-based multiclass intrusion detection. Feature selection is also used to reduce the feature space and classification time. For attack-type classification, we used CNN which is generally well-known for its better classification ability on image recognition tasks. We have exploited this ability to develop an IDS that can identify different types of intrusions ranging from 4 to 12 types. In our study, we evaluated our proposed Context-aware Feature Extraction-based CNN IDS on different datasets with multiple classes where it was able to successfully improve classification accuracy compared to the models with no preprocessing steps and other existing methods. We carried out the performance evaluation and comparison using four different datasets, NSL-KDD, CICIDS2017, ADFA-LD, and ADFA-WD. These datasets have either host-based or network-based features, which is another area that we investigated in this paper.

Challenges and Future Directions for Intrusion Detection Systems Based on AutoML

Recent use of computer systems and the Internet has contributed to severe protection, privacy and confidentiality problems due to the processes involved in the electronic data transformation. Much has been done to improve the security and privacy of information systems, but these issues remain in computer systems; there is, in fact, no system in the world That is early stable. Furthermore, various network attacks develop when the signature database incorporates a new signature with irregular behaviour. With many types of attacks emerging, many techniques are being built and used in many forms of network attacks. Intrusion detection systems ( IDS) are one of those methods. This method allows the management of several network networks, cloud storage and an information system. The IDS can track and detect attacks to breach a system's security features (confidentiality, availability, and integrity). This research aims at classifying IDS based on their intended goal and to compare different types of IDS in each class.