U2R Attacks Research Articles

Network Intrusion Detection and Prevention System Using Hybrid Machine Learning with Supervised Ensemble Stacking Model

Network intrusion detection systems play a critical role in protecting a variety of services ranging from economic through social to commerce. However, the growing level and sophistication of malicious attacks launched on networks in the current technological landscape have necessitated the need for advanced and robust detection mechanisms to mitigate against security breaches of confidentiality, integrity, and denial‐of‐service. In this paper, we present a hybrid intrusion detection system that combines supervised and unsupervised learning models through an ensemble stacking model to increase the detection accuracy rates of attacks in networks while minimising false alarms. Three machine learning algorithms comprising a multilayer perceptron neural network, a modified self‐organizing map, and a decision tree were used for the detection framework. The intrusion detection system was trained and evaluated on benchmark datasets: NSL‐KDD and CIC‐DDoS2019. The intrusion detection system was implemented as a Java solution and the detection performance was evaluated. A 10‐fold cross‐validation performance was also performed to validate how well the detection system predicts unknown attacks for prevention. The results of the tests revealed a detection accuracy of 99.84% of the instances in the NLS‐KDD dataset with a true positive rate of 99.8% and a false positive rate of 0.10% while a detection accuracy of 99.90% was achieved with the CIC‐DDoS2019 dataset. Furthermore, the detection system was effective in distinguishing attack traffic from normal traffic in the NSL‐KDD dataset and was able to adequately detect DOS, Probe, and R2L attacks with F1 scores of 100%, 99.6%, and 95.1%, respectively, which are significantly impressive. However, the detection of less frequency attack types such as U2R attacks was quite low with an F1 score of 62.5%. The detection performance of the proposed hybrid intrusion detection system suggests that it can be deployed in network security applications to detect packets that exhibit suspicious behaviour or indicate potential threats and respond appropriately to attacks. Implementing the detection framework as a Java solution makes it possible to deploy it across various operating system platforms without any impact on the detection performance.

Machine Learning Approach to Intrusion Detection: Performance Evaluation

Software-Defined Networking (SDN) simplifies network administration as well as reduces the need for manual configuration on individual devices. SDN is expected to remain a crucial technology in shaping the future of network infrastructure. However due to key vulnerabilities like Open Flow Protocol Weaknesses, Flow Table Poisoning, Weak authentication and authorization mechanisms, it is prone to intrusion attacks. In this paper, authors aim to build framework based on various machine learning models (ML) to capture anomaly packets. Four models Decision tree, Support Vector Classifier, Naïve Bayes Classifier and artificial neural networks are designed and trained to capture anomaly packets. While SVC achieved an impressive accuracy of 99%, Artificial Neural Networks (ANN) demonstrated satisfactory speed and efficiency, despite their accuracy being slightly lower than SVM’s. ANN is then deployed in SDN simulated using Mininet. The model is able to detect all DOS traffic. Other types of attacks SQL Injection, U2R Attack, Buffer Overflow Attack, Probe Attack, Brute Force Attack could not be tested as there is provision to simulated these using Mininet.

An improved long short term memory network for intrusion detection.

Over the years, intrusion detection system has played a crucial role in network security by discovering attacks from network traffics and generating an alarm signal to be sent to the security team. Machine learning methods, e.g., Support Vector Machine, K Nearest Neighbour, have been used in building intrusion detection systems but such systems still suffer from low accuracy and high false alarm rate. Deep learning models (e.g., Long Short-Term Memory, LSTM) have been employed in designing intrusion detection systems to address this issue. However, LSTM needs a high number of iterations to achieve high performance. In this paper, a novel, and improved version of the Long Short-Term Memory (ILSTM) algorithm was proposed. The ILSTM is based on the novel integration of the chaotic butterfly optimization algorithm (CBOA) and particle swarm optimization (PSO) to improve the accuracy of the LSTM algorithm. The ILSTM was then used to build an efficient intrusion detection system for binary and multi-class classification cases. The proposed algorithm has two phases: phase one involves training a conventional LSTM network to get initial weights, and phase two involves using the hybrid swarm algorithms, CBOA and PSO, to optimize the weights of LSTM to improve the accuracy. The performance of ILSTM and the intrusion detection system were evaluated using two public datasets (NSL-KDD dataset and LITNET-2020) under nine performance metrics. The results showed that the proposed ILSTM algorithm outperformed the original LSTM and other related deep-learning algorithms regarding accuracy and precision. The ILSTM achieved an accuracy of 93.09% and a precision of 96.86% while LSTM gave an accuracy of 82.74% and a precision of 76.49%. Also, the ILSTM performed better than LSTM in both datasets. In addition, the statistical analysis showed that ILSTM is more statistically significant than LSTM. Further, the proposed ISTLM gave better results of multiclassification of intrusion types such as DoS, Prob, and U2R attacks.

IoTTPS: Ensemble RKSVM Model-Based Internet of Things Threat Protection System.

An Internet of Things (IoT) network is prone to many ways of threatening individuals. IoT sensors are lightweight, lack complicated security protocols, and face threats to privacy and confidentiality. Hackers can attack the IoT network and access personal information and confidential data for blackmailing, and negatively manipulate data. This study aims to propose an IoT threat protection system (IoTTPS) to protect the IoT network from threats using an ensemble model RKSVM, comprising a random forest (RF), K nearest neighbor (KNN), and support vector machine (SVM) model. The software-defined networks (SDN)-based IoT network datasets such as KDD cup 99, NSL-KDD, and CICIDS are used for threat detection based on machine learning. The experimental phase is conducted by using a decision tree (DT), logistic regression (LR), Naive Bayes (NB), RF, SVM, gradient boosting machine (GBM), KNN, and the proposed ensemble RKSVM model. Furthermore, performance is optimized by adding a grid search hyperparameter optimization technique with K-Fold cross-validation. As well as the NSL-KDD dataset, two other datasets, KDD and CIC-IDS 2017, are used to validate the performance. Classification accuracies of 99.7%, 99.3%, 99.7%, and 97.8% are obtained for DoS, Probe, U2R, and R2L attacks using the proposed ensemble RKSVM model using grid search and cross-fold validation. Experimental results demonstrate the superior performance of the proposed model for IoT threat detection.

I-2NIDS Novel Intelligent Intrusion Detection Approach for a Strong Network Security

The potential of machine learning mechanisms played a key role in improving the intrusion detection task. However, other factors such as quality of data, overfitting, imbalanced problems, etc. may greatly affect the performance of an intelligent intrusion detection system (IDS). To tackle these issues, this paper proposes a novel machine learning-based IDS called i-2NIDS. The novelty of this approach lies in the application of the nested cross-validation method, which necessitates using two loops: the outer loop is for hyper-parameter selection that costs least error during the run of a small amount of training set and the inner loop for the error estimation in the test set. The experiments showed significant improvements within NSL-KDD dataset with a test accuracy rate of 99.97%, 99.79%, 99.72%, 99.96%, and 99.98% in detecting normal activities, DDoS/DoS, Probing, R2L and U2R attacks, respectively. The obtained results approve the efficiency and superiority of the approach over other recent existing experiments.

A Novel Method for Anomaly Detection in the Internet of Things using Whale Optimization Algorithm

The Internet of Things (IoT) is integral to human life due to its pervasive applications in home appliances, surveillance, and environment monitoring. Resource-constrained IoT devices are easily accessible to attackers due to their direct connection to the unsafe Internet. Public access to the Internet makes IoT objects more susceptible to intrusion. As the name implies, anomaly detection systems are designed to identify anomalous traffic patterns that conventional firewalls fail to detect. Effective Intrusion Detection Systems (IDSs) design faces three major problems, including handling high dimensionality, selecting a learning algorithm, and comparing entered observations and traffic patterns using a distance or similarity measure. Considering the dynamic nature of the entities involved and the limited computing resources available, more than traditional anomaly detection approaches is required. This paper proposes a novel method based on Whale Optimization Algorithm (WOA) to detect anomalies in IoT-based networks that conventional firewall systems cannot detect. Experiments are conducted on the KDD dataset. The accuracy of the proposed method is compared for classifiers such as kNN, SVM, and DT approaches. The detection accuracy rate of the proposed method is significantly higher than that of other methods for DoS, probing, normal attacks, R2L attacks, and U2R attacks compared to other methods. This method shows an impressive increase in accuracy when detecting a wide range of malicious activities, from DoS, probing, and privilege escalation attacks, to remote-to-local and user-to-root attacks.

NIDD: an intelligent network intrusion detection model for nursing homes

AbstractIn nursing homes using technologies such as IoT, big data, cloud computing, and machine learning, there is a constant risk of attacks such as Brute Force FTP, Brute Force SSH, Web Attack, Infiltration, and Botnet during data communication between individual terminals and the cloud server. Therefore, effectively identifying network communication data is essential to protect data communication security between individual terminals and the cloud server. Aiming at the data mentioned above regarding communication security issues, we propose an intelligent intrusion detection model NIDD (Network Intelligent Data Detection) model that combines deep convolution generation adversarial network (DCGAN) with Light Gradient Boosting Machine (LightGBM) and Shapley Additive exPlanations (SHAP). The NIDD model first generates new attack samples by learning the feature distribution of the existing attack sample data and effectively expands the rare attack samples. Secondly, we use the Light Gradient Boosting Machine (LightGBM) algorithm as the base classifier to train the dataset and start to build the intrusion detection model. Then use Shapley Additive exPlanations (SHAP) to analyze the contribution of the classification results, and adjust the model parameters according to the analysis results. Finally, we obtain the optimal model for the intelligent detection model of network intrusion. This paper conducts experimental tests on the NSL-KDD dataset. The experimental results show that the NIDD model built based on Light Gradient Boosting Machine can detect Brute Force FTP, Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet, PROBE, R2L, and U2R attacks with an accuracy of 99.76%. Finally, we re-verified the NIDD model on the CIC-IDC-2018 dataset. The results once again proved that the NIDD model could solve the data communication security between the nursing robot and the cloud server and the data before the IoT terminal and the cloud server. Communication security provides a sufficient guarantee.

Research on intrusion detection method based on 1D-ICNN-BiGRU

Intrusion detection is one of the effective ways to secure the network. Based the unbalanced network traffic data between different attacks, the intrusion detection algorithm turns out to be low intrusion detection accuracy and low identification rate of minority attacks. To solve the problems, an improved intrusion detection model combined with one-dimensional convolutional neural network and bidirectional gated recurrent unit(1D-ICNN-BiGRU) is proposed. First, the dataset is balanced by the SMOTE-Tomek algorithm, then 1D-ICNN-BiGRU is performed for feature extraction, and the final fully connected layer of the model is replaced by global average pooling. The results show that based on the balanced data, the proposed model achieves higher intrusion detection accuracy for R2L and U2R attack than other classic intrusion detection models. The proposed model also improved the identification rate of minority attacks, making the model accuracy rate reach 95.53%, and the false positive rate is only 2.98%.

Cyber Attacks Prediction using Data Science

Cyber-attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information. The state of the cyberspace portends uncertainty for the future Internet and its accelerated number of users. New paradigms add more concerns with big data collected through device sensors divulging large amounts of information, which can be used for targeted attacks. Though a plethora of extant approaches, models and algorithms have provided the basis for cyber-attack predictions, there is the need to consider new models and algorithms, which are based on data representations other than task-specific techniques. However, its non-linear information processing architecture can be adapted towards learning the different data representations of network traffic to classify type of network attack. In this paper, we model cyber-attack prediction as a classification problem, Networking sectors have to predict the type of Network attack from given dataset using machine learning techniques. The analysis of dataset by supervised machine learning technique(SMLT) to capture several information’s like, variable identification, uni- variate analysis, bi-variate and multi-variate analysis, missing value treatments etc. A comparative study between machine learning algorithms had been carried out in order to determine which algorithm is the most accurate International Journal of Scientific Research in Engineering and Management (IJSREM) Volume: 06 Issue: 03 | March - 2022 ISSN: 2582-3930 © 2022, IJSREM | www.ijsrem.com DOI: 10.55041/IJSREM11906 | Page 2 in predicting the type cyber Attacks. We classify four types of attacks are DOS Attack, R2L Attack, U2R Attack, Probe attack. The results show that the effectiveness of the proposed machine learning algorithm technique can be compared with best accuracy with entropy calculation, precision, Recall, F1 Score, Sensitivity, Specificity and Entropy. Keywords Cyber-attack, Cyberspace, DOS Attack, R2L Attack, U2R Attack, Probe attack

A Novel Binary Search Tree Method to Find an Item Using Scaling

This Approach comprises of methods to produce novel and efficient methods to implement search of data objects in various applications. It is based on the best match search to implement proximity or best match search over complex or more than one data source. In particular with the availability of very large numeric data set in the present day scenario. The proposed approach which is based on the Arithmetic measures or distance measures called as the predominant Mean based algorithm. It is implemented on the longest common prefix of data object that shows how it can be used to generate various clusters through combining or grouping of data, as it takes O(log n) computational time. And further the approach is based on the process of measuring the distance which is suitable for a hierarchy tree property for proving the classification is needed one for storing or accessing or retrieving the information as required. The results obtained illustrates overall error detection rates in generating the clusters and searching the key value for Denial of Service (DOS) attack 5.15%, Probe attack 3.87%, U2R attack 8.11% and R2L attack 11.14%. as these error detection rates denotes that our proposed algorithm generates less error rates than existing linkage methods.

A Hybrid Approach for Network Intrusion Detection

Due to the widespread use of the internet and smart devices, various attacks like intrusion, zero-day, Malware, and security breaches are a constant threat to any organization's network infrastructure. Thus, a Network Intrusion Detection System (NIDS) is required to detect attacks in network traffic. This paper proposes a new hybrid method for intrusion detection and attack categorization. The proposed approach comprises three steps to address high false and low false-negative rates for intrusion detection and attack categorization. In the first step, the dataset is preprocessed through the data transformation technique and min-max method. Secondly, the random forest recursive feature elimination method is applied to identify optimal features that positively impact the model's performance. Next, we use various Support Vector Machine (SVM) types to detect intrusion and the Adaptive Neuro-Fuzzy System (ANFIS) to categorize probe, U2R, R2U, and DDOS attacks. The validation of the proposed method is calculated through Fine Gaussian SVM (FGSVM), which is 99.3% for the binary class. Mean Square Error (MSE) is reported as 0.084964 for training data, 0.0855203 for testing, and 0.084964 to validate multiclass categorization.

A bidirectional LSTM deep learning approach for intrusion detection

The rise in computer networks and internet attacks has become alarming for most service providers. It has triggered the need for the development and implementation of intrusion detection systems (IDSs) to help prevent and or mitigate the challenges posed by network intruders. Over the years, intrusion detection systems have played and continue to play a very significant role in spotting network attacks and anomalies. Numerous researchers around the globe have proposed many IDSs to combat the threat of network invaders. However, most of the previously proposed IDSs have high rates of raising false alarms. Additionally, most existing models suffer the difficulty of detecting the different attack types, especially User-to-Root (U2R) and Remote-to-Local (R2L) attacks. These two types of attacks often appear to have lower detection accuracy for the existing models. Hence, in this paper, we propose a bidirectional Long-Short-Term-Memory (BiDLSTM) based intrusion detection system to handle the challenges mentioned above. To train and measure our model’s performance, we use the NSL-KDD dataset, a benchmark dataset for most IDSs. Experimental results show and validate the effectiveness of the BiDLSTM approach. It outperforms conventional LSTM and other state-of-the-art models in terms of accuracy, precision, recall, and F-score values. It also has a much more reduced false alarm rate than the existing models. Furthermore, the BiDLSTM model achieves a higher detection accuracy for U2R and R2L attacks than the conventional LSTM.

An ensemble based approach for effective intrusion detection using majority voting

Of late, Network Security Research is taking center stage given the vulnerability of computing ecosystem with networking systems increasingly falling to hackers. On the network security canvas, Intrusion detection system (IDS) is an essential tool used for timely detection of cyber-attacks. A designated set of reliable safety has been put in place to check any severe damage to the network and the user base. Machine learning (ML) is being frequently used to detect intrusion owing to their understanding of intrusion detection systems in minimizing security threats. However, several single classifiers have their limitation and pose challenges to the development of effective IDS. In this backdrop, an ensemble approach has been proposed in current work to tackle the issues of single classifiers and accordingly, a highly scalable and constructive majority voting-based ensemble model was proposed which can be employed in real-time for successfully scrutinizing the network traffic to proactively warn about the possibility of attacks. By taking into consideration the properties of existing machine learning algorithms, an effective model was developed and accordingly, an accuracy of 99%, 97.2%, 97.2%, and 93.2% were obtained for DoS, Probe, R2L, and U2R attacks and thus, the proposed model is effective for identifying intrusion.

Feature Dependent Naïve Bayes For Network Intrusion Detection System

The intrusion detection system is an important component that performs the analysis for. the problem arising from the IDS is a collection of data sets in a computer network. to increase the high level and low false positive level of approach with the learning machine in applied. The data mining algorithm used is Naïve bayes one of the most widely used algorithms in space due to its simplicity, efficiency and effectiveness. NB has high accuracy and speed when applied into the database with large data. However, the NB algorithm assumes independent attributes (free) and is very sensitive to the selection of many features that interfere with the performance or accuracy of the NB to be low but in practice, the possibilities of the feature are interrelated. The Feature Dependent Naïve Bayes (FDNB) method is an effective method used to solve existing problems in NB by computing features as pairs and creating dependencies between each other as well as by applying learning models implemented to cross-validation, Feature Selection and data steps preprocessing that gives better accuracy results. After testing with two models of Naïve bayes and FDNB, the results obtained from the Naïve Bayes algorithm resulted in an accuracy of 84.42%, while for FDNB and oversampling (CFS + GS) the accuracy was 94.58%, FDNB and oversampling (CFS + BFS) the accuracy value of 94.69%, FDNB and SMOTE (CFS + GS) and FDNB and SMOTE (CFS + BFS) has an accuracy value of 93.27%. For the average per attack type DOS attack shows the highest result for its accuracy value of 97.86% and U2R attack produces the best accuracy when classifying U2R with 93.80% accuracy, U-F size of 96.26% U2R can be considered as a very result nice. Because U2R attack is considered very dangerous.

Adoption and realization of deep learning in network traffic anomaly detection device design

In order to study the application of deep learning in the design of network traffic anomaly detection device, aiming at two common problems in the field of network anomaly detection: characteristic dependence and high false positive rate, the convolutional neural network (CNN) is combined with recurrent neural network (RNN) to propose the network anomaly detection method based on hierarchical spatiotemporal feature learning (HAST-NAD) based on deep learning. It automatically learns the traffic characteristics and improves the network traffic anomaly detection efficiency. First, the CNN is used to learn the spatial feature algorithm of data, and long-short term memory of RNN is used to learn the temporal feature algorithm of data. Then the two original data sets DARPA1998 and ISCX2012 are preprocessed. The accuracy, detection rate, and false positive rate of normal traffic and Dos, Probe, U2R, and R2L attack traffic are compared in DARPA1998 data set. The accuracy, detection rate, and false positive rate of normal traffic and Brute force SSH, DDoS, HttpDoS, and buffering attack traffic are compared in ISCX2012 data set. Finally, it is compared with other network traffic anomaly detection methods. The results show that when the network flow length is 800, the model shows good performance on the DARPA1998 data set (accuracy, detection rate and false positive rate are 98.68%, 97.78%, and 0.07%, respectively). When the network flow length is 600, the model performs better on the ISCX2012 dataset (accuracy, detection rate and false positive rate are 99.69%, 96.91%, and 0.22%, respectively). At the same time, when the packet length is 100 and the number of packets is 6, the model shows high precision, high detection rate, and low false positive rate on ISCX2012 data set. In the same data set, the temporal feature algorithm has better performance and lower false positive rate than the spatial feature algorithm. Compared with other network traffic anomaly detection methods, HAST-NAD has better comprehensive test results. In conclusion, the combination of CNN and RNN can better realize abnormal detection of network traffic, which has practical application and theoretical value.

Prediction of Network Attacks using Bio-Inspired Machine Learning Algorithm

Most of the times, data is created for the Intrusion Detection System (IDS) only when the set of all real working environments are explored under all the possibilities of attacks, which is an expensive task. Network Intrusion Detection software shields a system and computer network from staff and non-authorized users. The detector’s ultimate task is to build a foreboding classifier (i.e. a model) which would help in distinguishing between friendly and non-friendly connections, known as attacks or intrusions.This problem in network sectors is prevented by predicting whether the connection is attacked or not attacked from the dataset. We are using i.e. KDDCup99 using bio inspired machine learning techniques (like Artificial Neural Network). Bio inspired algorithm is a game changer in computer science. The extent of this field is really magnificent as compared to nature around it, complications of computer science are only a subset of it, opening a new era in next generation computing, modelling and algorithm engineering. The aim is to investigate bio inspired machine learning based techniques for better packet connection transfers forecasting by prediction results in best accuracy and to propose this machine learning-based method to accurately predict the DOS, R2L, U2R, Probe and overall attacks by predicting results in the form of best accuracy from comparing supervised classification machine learning algorithms. Furthermore, to compare and discuss the performance of various ML algorithms from the provided dataset with classification and evaluation report, finding and analysing the confusion matrix and for classifying data from the priority and result shows that the effectiveness of the proposed system i.e. bio inspired machine learning algorithm technique can be put on test with best accuracy along with precision, specificity, sensitivity, F1 Score and Recall.

Fuzzy Generalized Hebbian Algorithm for Large-Scale Intrusion Detection System

The huge number of irrelevant and redundant data used in building intrusion detection systems (IDS) is one of the common issues in network intrusion detection systems. This paper proposed the use of Fuzzy Generalized Hebbian Algorithm as a novel data reduction method to overcome this problem of data redundancy in IDS. Two methods for dimensionality reduction (GHA and Fuzzy GHA) were used and compared in this study. This allowed retaining the most relevant traffic data information from the network. Furthermore, the K Nearest Neighbor algorithm was applied for the classification of the test connections into 2 categories (attack or normal). The investigations were carried out on the KDDCUP ‘99 dataset and the results showed the Fuzzy GHA method to perform better than GHA in the detection of both U2R and DoS attacks.

Siam-IDS: Handling class imbalance problem in Intrusion Detection Systems using Siamese Neural Network

Abstract To tackle new and complex attacks, modern Intrusion Detection Systems (IDSs) are developed using Deep Learning (DL) techniques and are trained on intrusion detection datasets such as KDD and NSL-KDD. These two datasets have a large number of samples in Denial of Service and Probe attack classes besides the Normal class, but the number of samples in Remote to Local (R2L) and User to Root (U2R) attack classes is very less. R2L and U2R attacks represent the minority classes of these two datasets and due to lack of training samples in these minority classes, DL based IDSs are unable to detect them accurately. This leads to class imbalance problem and increases the chances of the network being compromised due to undetected intrusions. To handle this class imbalance problem in IDSs, this paper proposes Siam-IDS which is a novel IDS based on Siamese Neural Network (Siamese-NN). The proposed Siam-IDS is able to detect R2L and U2R attacks without using traditional class balancing techniques such as oversampling and random undersampling. The performance of Siam-IDS was compared with existing IDSs developed using DL techniques namely Deep Neural Network (DNN) and Convolutional Neural Network (CNN). Siam-IDS was able to achieve higher recall values for both R2L and U2R attack classes when compared to its counterparts.

Proportional Voting based Semi-Unsupervised Machine Learning Intrusion Detection System

Proportional Voting based Semi-Unsupervised Machine Learning Intrusion Detection System Yang G. Kim, Ohbong Kwon, John Yoon Abstract Feature selection of NSL-KDD data set is usually done by finding co-relationships among features, irrespective of target prediction. We aim to determine the relationship between features and target goals to facilitate different target detection goals regardless of the correlated feature selection. The unbalanced data structure in NSL-KDD data can be relaxed by Proportional Representation (PR). However, adopting PR would deny the notion of winner-take-all by attracting a majority of the vote and also provide a fairly proportional share for any grouping of like-minded data. Furthermore, minorities and majorities would get a fair share of power and representation in data structure distribution. Particle Swarm Optimization (PSO) utilizes attack data for minority while majority employs non-attack data along with targeted classes to increase detection rate and reduce false alarms, especially for R2L and U2R attacks, as the output target goal influences feature selections and corresponding detection rate and false alarm rate. Our simulation study confirms the feasibility of the Voting Representation for minority protection and increased detection rate while reducing false alarms, which is favorable to minority over the majority. Full Text: PDF DOI: 10.15640/jcsit.v8n2a1

Study on Network Security Based on PCA and BP Neural Network Under Green Communication

In response to the energy consumption caused by the exponential growth of mobile network capacity demand, the Chen Shanzhi team proposed a user-centric ultra-dense network. It dynamically organizes multiple access nodes into a group of access nodes centered on the user. It can “accompany” user services without perception. The result is increased system capacity and user experience. This paper systematically analyzes the key security issues of user-centric ultra-dense networks. Based on the security characteristics of the access node group, a security system adapted to the user-centered ultra-dense network architecture is designed. Aiming at the problem of data security transmission between network entities, a lightweight data security transmission algorithm based on implicit certificate is proposed. The algorithm uses a lightweight implicit certificate to generate a temporary session key by means of a reconfigurable public-private key pair, so as to encrypt and protect the transmitted data, and solve the problem of data security transmission when the access nodes cooperate. The simulation shows that the algorithm consumes 34kB less on average than the traditional key method in different scenarios, and the speed is fast and the encryption key remains stable. At the same time, it also saves storage space and can be conveniently applied to access nodes with limited resources. Then, aiming at the network information security problem, an information security detection method based on improved BP neural network based on PCA is proposed. Simulation experiments were carried out on four types of attack types using the KDD CUP data set. The simulation results show that the improved BP neural network classifier combined with PCA has higher performance in network training. The false alarm rate for the DOS, R2L and PROBE attack types dropped to about 10%, and the false alarm rate for the U2R attack types dropped by 8.07%.