UNSW-NB15 Dataset Research Articles

Optimal Machine Learning Based Intrusion Detection System in Wireless Sensor Networks for Surveillance Applications

Security is considered as a major design issue in wireless sensor network (WSN) and can be solved by the use of intrusion detection systems (IDS). In this view, this paper devises a new k-means clustering with optimal support vector (KM-OSVM) based IDS for WSN. The KM-OSVM model incorporates preprocessing, clustering, classification, and parameter tuning. Primarily, data preprocessing and K-means clustering technique are applied to group the data instances into a set of clusters. Besides, SVM based classification technique is employed to allot class labels, and the parameters in SVM are optimally adjusted by the use of crow search optimization (CSO) algorithm, shows the novelty of the work. The experimental outcome of the KM-OSVM model is examined using UNSW-NB15 and CICIDS2017 datasets. The obtained outcomes demonstrated that the KM-OSVM model ensured better performance with the maximum accuracy of 95.12% and 98.98% respectively. Therefore, the KM-OSVM model can be employed as an effective tool to achieve security in the resource constrained WSN.

Industrial IoT Intrusion Detection via Evolutionary Cost-Sensitive Learning and Fog Computing

Cyber attacks and intrusions have become the major obstacles to the adoption of the Industrial Internet of Things (IIoT) in critical industries. Imbalanced data distribution is a common problem in IIoT environments that negatively influence machine learning-based intrusion detection systems (IDSs). To address this issue, we introduce EvolCostDeep, a hybrid model of stacked autoencoders (SAE) and convolutional neural networks (CNNs) with a new cost-dependent loss function. The loss function aims to optimize the model’s parameters, where the costs are determined using an evolutionary algorithm. The combination of evolutionary algorithms and deep learning (DL) on Big data hinders the scalability of IIoT IDSs. In this regard, a fog computing-enabled framework, called DeepIDSFog, is designed at the data level, where the master node shares the EvolCostDeep model with worker nodes. In each fog worker node, the EvolCostDeep is parallelized through one task-level and two model-level mechanisms. After aggregating detection outputs from worker nodes to the master, the result is passed to the cloud platform for mitigating attacks. A series of experiments is conducted on the ToN-IoT and UNSW-NB15 data sets to evaluate the performance of EvolCostDeep and DeepIDSFog. The results show that our frameworks can effectively handle both class imbalance problem and scalability of big IIoT traffic data compared with the other models. The averaged values of the EvolCostDeep for recall, precision, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$F1$ </tex-math></inline-formula> -score on the data sets are of 93.3%, 97.6%, and 95.2%, respectively, which are higher than the compared methods. Also, the DeepIDSFog provides an average speedup of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$38.7\times $ </tex-math></inline-formula> over other comparing models.

A Hybrid Spider Monkey and Hierarchical Particle Swarm Optimization Approach for Intrusion Detection on Internet of Things.

The Internet of Things (IoT) network integrates physical objects such as sensors, networks, and electronics with software to collect and exchange data. Physical objects with a unique IP address communicate with external entities over the internet to exchange data in the network. Due to a lack of security measures, these network entities are vulnerable to severe attacks. To address this, an efficient security mechanism for dealing with the threat and detecting attacks is necessary. The proposed hybrid optimization approach combines Spider Monkey Optimization (SMO) and Hierarchical Particle Swarm Optimization (HPSO) to handle the huge amount of intrusion data classification problems and improve detection accuracy by minimizing false alarm rates. After finding the best optimum values, the Random Forest Classifier (RFC) was used to classify attacks from the NSL-KDD and UNSW-NB 15 datasets. The SVM model obtained accuracy of 91.82%, DT of 98.99%, and RFC of 99.13%, and the proposed model obtained 99.175% for the NSL-KDD dataset. Similarly, SVM obtained accuracy of 85.88%, DT of 88.87%, RFC of 91.65%, and the proposed model obtained 99.18% for the UNSW NB-15 dataset. The proposed model achieved accuracy of 99.175% for the NSL-KDD dataset which is higher than the state-of-the-art techniques such as DNN of 97.72% and Ensemble Learning at 85.2%.

CBA-CLSVE: A Class-Level Soft-Voting Ensemble Based on the Chaos Bat Algorithm for Intrusion Detection

Various machine-learning methods have been applied to anomaly intrusion detection. However, the Intrusion Detection System still faces challenges in improving Detection Rate and reducing False Positive Rate. In this paper, a Class-Level Soft-Voting Ensemble (CLSVE) scheme based on the Chaos Bat Algorithm (CBA), called CBA-CLSVE, is proposed for intrusion detection. The Support Vector Machine (SVM), K-Nearest Neighbor (KNN) and Decision Tree (DT) are selected as the base learners of the ensemble. The Chaos Bat Algorithm is used to generate class-level weights to create the weighted voting ensemble. A weighted fitness function considering the tradeoff between maximizing Detection Rate and minimizing False Positive Rate is proposed. In the experiments, the NSL-KDD, UNSW-NB15 and CICIDS2017 datasets are used to verify the scheme. The experimental results show that the class-level weights generated by CBA can be used to improve the combinative performance. They also show that the same ensemble performance can be achieved using about half the total number of features or fewer.

Performance Investigation of Principal Component Analysis for Intrusion Detection System Using Different Support Vector Machine Kernels

The growing number of security threats has prompted the use of a variety of security techniques. The most common security tools for identifying and tracking intruders across diverse network domains are intrusion detection systems. Machine Learning classifiers have begun to be used in the detection of threats, thus increasing the intrusion detection systems’ performance. In this paper, the investigation model for an intrusion detection systems model based on the Principal Component Analysis feature selection technique and a different Support Vector Machine kernels classifier is present. The impact of various kernel functions used in Support Vector Machines, namely linear, polynomial, Gaussian radial basis function, and Sigmoid, is investigated. The performance of the investigation model is measured in terms of detection accuracy, True Positive, True Negative, Precision, Sensitivity, and F-measure to choose an appropriate kernel function for the Support Vector Machine. The investigation model was examined and evaluated using the KDD Cup’99 and UNSW-NB15 datasets. The obtained results prove that the Gaussian radial basis function kernel is superior to the linear, polynomial, and sigmoid kernels in both used datasets. Obtained accuracy, Sensitivity, and, F-measure of the Gaussian radial basis function kernel for KDD CUP’99 were 99.11%, 98.97%, and 99.03%. for UNSW-NB15 datasets were 93.94%, 93.23%, and 94.44%.

SPIDER: A shallow PCA based network intrusion detection system with enhanced recurrent neural networks

In recent years, ensuring the stability of the huge volume of data generated by billions of users has become the main concern in the field of cyber security. Network security is an extensive part of the cyber security system where intrusions are the leading threat in its way of defense. As a countermeasure to such intrusions in the network, Intrusion Detection Systems (IDSs) have played a major role over the years. Although countless works have already been carried out in this field, most of these works have lagged at some points, considering the scope of exploration through recent extensions. So in this paper, a network anomaly detection model, SPIDER, has been proposed. The SPIDER model combines four updated versions of conventional Recurrent Neural Networks (RNNs), namely Bi-LSTM (Bidirectional Long Short Term Memory), LSTM (Long Short Term Memory), Bi-GRU (Bidirectional Gated Recurrent Unit), and GRU (Gated Recurrent Unit). To deal with the dimensionality problems, Principal Component Analysis (PCA) has been adapted to reduce the data dimensions. The performance of the proposed SPIDER model has been evaluated using the well-known NSL-KDD and UNSW-NB15 datasets to ensure its robustness. When compared to the corresponding values of different models, the proposed model shows a significant improvement in detecting intrusions over existing models.

Application of Improved Butterfly Optimization Algorithm Combined with Black Widow Optimization in Feature Selection of Network Intrusion Detection

Feature selection is a very important direction for network intrusion detection. However, current feature selection technology of network intrusion detection has the problems of low detection rate and low accuracy due to feature redundancy. An improved Butterfly Optimization Algorithm combined with Black Widow Optimization (BWO-BOA) is proposed in this paper, which introduces a dynamic adaptive search strategy in the global search phase of the Butterfly Optimization Algorithm (BOA), uses the movement search process of Black Widow Optimization (BWO) algorithm as the local search, and at the same time, in order to overcome the improved butterfly optimization algorithm easily falling into a local optimum in local search phase, takes advantage of the small probability mutation strategy to filter out the redundant features. This paper then tries to apply the proposed BWO-BOA algorithm to feature selection of network intrusion detection. In order to verify the performance of the proposed BWO-BOA algorithm, the UNSW-NB15 dataset is selected for binary classification and multi-classification simulation experiments, and the feature selection models of BWO-BOA algorithm, BOA algorithm, BWO algorithm, Particle Swarm Optimization, Salp Swarm Algorithm, Whale Optimization Algorithm and improved Butterfly Optimization Algorithm are compared for validation. The experimental results show that the proposed BWO-BOA algorithm can enhance the performance of the feature selection model in network intrusion detection and significantly boost the reduction of feature dimensions.

A hierarchical intrusion detection system based on extreme learning machine and nature-inspired optimization

The surge in cyber-attacks has driven demand for robust Intrusion detection systems (IDSs) to protect underlying data and sustain availability of network services. Detecting and classifying multiple type of attacks requires robust machine learning approaches that can analyze network traffic and take appropriate measures. Traffic data usually consists of redundant, irrelevant, and noisy information, which could have a negative influence on the model performance. In this paper, we propose an improved bio-inspired meta-heuristic algorithm for efficient detection and classification of multi-stage attacks. The proposed model uses a one-versus-all sub-model based technique to deal with the multi-class classification problem. Each sub-model employs an enhanced Harris Hawk optimization with extreme learning machine (ELM) as the base classifier. This hierarchy produces the best subset of features per attack, along with optimized ELMs weights, which can improve the detection rate significantly. The proposed technique was tested against various meta-heuristic algorithms and multi-class classifiers using the UNSWNB-15 dataset. In seven different types of attacks, experimental results outperformed other existing methods in terms of decreasing the crossover-error rate and obtaining the best values for the G-mean measure.

Malicious attacks detection using GRU-BWFA classifier in pervasive computing

With the advanced trends in pervasive computing, the data users were subjected to face different kinds of attacks. Several algorithms for attack detection was performed with minimal accuracy in prediction and consideration of performance metrics was not effective. Hence effective and prompt detection of malicious attacks must be optimized in terms of confidentiality, privacy, availability and integrity. Accordingly, the proposed research paper provides an effective mechanism for detecting and classifying DDoS attacks such as TCP-SYN, UDP flood, ICMP echo, HTTP flood, Slow Loris Slow Post and Brute Force attack, by utilizing machine learning methods within the UNSW-NB15 dataset and NSL-KDD dataset. Significantly, Gated Recurrent Unit Neural Network based on Bidirectional Weighted Feature Averaging (GRU-BWFA) classifier is utilized as a proposed classifier approach for high detection rate and accuracy in distinguishing the mentioned DDoS attacks. Feature selection is performed using the Enhanced Salp Swarm Optimization technique to select the optimal features for identifying the attacks. The proposed classifier evaluates with other different classifiers which provide a detailed study in detecting DDoS attacks using the UNSW-NB15 dataset and NSL-KDD dataset. The proposed model results 0.9936 accuracy for UNSW-NB 15 dataset and 0.9918 accuracy for NSL-KDD dataset. Empirical findings indicate that machine learning methods are highly effective at detecting and classifying attacks with a higher accuracy rate.

A Cloud Security Attack Detection Using Proposed BGRU and Bi-LSTM Models

Abstract: In recent years, businesses and organizations have placed significant emphasis on network security. Through the network, the attackers were able to exploit flaws in the network setup. Numerous secure solutions, the most of which are based on attack signatures, have been developed to safeguard communication in such an environment. These systems are often ineffective in detecting every type of attack. Recently, the approach of deep learning has been presented. In this research, we propose a hybrid model that combines the BGRU and Bi-LSTM models for detecting and preventing cloud-based attacks. We have used one hot encoding for data preprocessing and select k best features for feature selection. There have been experiments conducted on the UNSW-NB15 dataset. These experiments have been conducted using the Python simulation tool and the Jupyter notebook environment. The findings indicate that it has a higher rate of network attack &amp; intrusion detection and classification accuracy of above 95 percent

DETECTION OF BOTNET ATTACK IN INTERNET OF THINGS USING FEATURE SELECTION ENABLE MACHINELERANING TECHNIQUE

The Internet of Things (IoT) is very rapidly developing with millions of devices that are usedin the smart home ,smart city ,and many other smart systems for education and so on . On the other side , attackers are mostly targeting these devices. After infecting malware attacks on these devices ,they become bots that are controlled by attackers ,and these will be targeted to these organization not only for stealing important information but also for breaking down of the network. Although certain security measures have been created to guard against cyber-attacks, themajority of these systems are rule-based. Additionally, malware attackers may be able to avoid the formal rulebased detection. Theabsence of earlier detection strategies is thereforefilled by the machine learningbased detection scheme. The public IDS dataset N-baloT andmachine learning techniques like the CART algorithm provide the foundation of thesuggested detection architecture. Machine learning models based on four classifiers are built :Naïve bayes ,K-nearest neighbour ,Support vector Machine ,and decision trees. Using 82,000 records from UNSW-NB15 dataset, the decision tree model has yieldedthe best overall result with 99,89% testing accuracy, 100% precision, 100% recall, and 100% F-score in detecting botnet attacks.

Efficient, Lightweight Cyber Intrusion Detection System for IoT Ecosystems Using MI2G Algorithm

The increase in internet connectivity has led to an increased usage of the Internet of Things (IoT) and devices on the internet. These IoT devices are becoming the backbone of Industry 4.0. The dependence on IoT devices has made them vulnerable to cyber-attacks. IoT devices are often deployed in harsh conditions, challenged with less computational costs, and starved with energy. All these limitations make it tough to deploy accurate intrusion detection systems (IDSs) in IoT devices and make the critical IoT ecosystem more susceptible to cyber-attacks. A new lightweight IDS and a novel feature selection algorithm are introduced in this paper to overcome the challenges of computational cost and accuracy. The proposed algorithm is based on the Information Theory models to select the feature with high statistical dependence and entropy reduction in the dataset. This feature selection algorithm also showed an increase in performance parameters and a reduction in training time of 27–63% with different classifiers. The proposed IDS with the algorithm showed accuracy, Precision, Recall, and F1-Score of more than 99% when tested with the CICIDS2018 dataset. The proposed IDS is competitive in accuracy, Precision, Recall, and training time compared to the latest published research. The proposed IDS showed consistent performance on the UNSWNB15 dataset.

Efficient Approach for Anomaly Detection in Internet of Things Traffic Using Deep Learning

The network intrusion detection system (NIDs) is a significant research milestone in information security. NIDs can scan and analyze the network to detect an attack or anomaly, which may be a continuing intrusion or perhaps an intrusion that has just occurred. During the pandemic, cybercriminals realized that home networks lurked with vulnerabilities due to a lack of security and computational limitations. A fundamental difficulty in NIDs is providing an effective, robust, lightweight, and rapid framework to perform real-time intrusion detection. This research proposes an efficient, functional cybersecurity approach based on machine/deep learning algorithms to detect anomalies using lightweight network-based IDs. A lightweight, real-time, network-based anomaly detection system can be used to secure connected IoT devices. The UNSW-NB15 dataset is used to evaluate the proposed approach DeepNet and compare results alongside other state-of-the-art existing techniques. For the classification of network-based anomalies, the proposed model achieves 99.16% accuracy by using all features and 99.14% accuracy after feature reduction. The experimental results show that the network anomalies depend exceptionally on features selected after selection.

A new intrusion detection system based on using non-linear statistical analysis and features selection techniques

The increase in the number of connected devices to the Internet and Internet of Things (IoT) development accompanied a massive increase in the number and types of attacks. Most IoT devices have security vulnerabilities due to their limited computing and storage capabilities and specific protocols. Thus, there is essential to build Intrusion Detection Systems (IDSs) that can detect these threats that affect smart applications. Researchers examined different data mining techniques, statistical analysis techniques, and machine learning (ML) algorithms. In this paper, we propose a novel approach for building an anomaly-based intrusion detection system based on using a non-linear statistical analysis technique called recurrence quantification analysis (RQA). Our approach uses RQA to identify abnormal behavior in an individual feature extracted from a series of packets rather than inspecting the packet's payload. The proposed procedure implies finding the minimum number of features, applying the RQA technique to each effective feature separately, and applying different ML algorithms to classify the RQA measurements resulting from each effective feature. The system's performance was evaluated based on the accuracy and F-score using the UNSW-NB15 dataset. Results show our proposed approach's effectiveness in discovering hidden characteristics in the underlying series of an individual feature that leads to identifying different attacks. Besides, the proposed approach outperforms most previous works using one feature.

Fast Anomaly Identification Based on Multiaspect Data Streams for Intelligent Intrusion Detection Toward Secure Industry 4.0

Various cyber attacks often occur in logistics network of the Industry 4.0, which poses a threat to Internet security. Intrusion detection can intelligently detect anomalous activities and secure the Internet with the help of anomaly detection algorithms. Different from static data, intrusion detection data are a dynamic data form and have the following characteristics. First, it is multiaspect. Second, it contains point anomalies and group anomalies. Third, there are correlations between different attributes. Nevertheless, these properties pose a challenge on existing anomaly detection approaches. Thus, a novel anomaly detection approach MDS_AD is proposed in this article to deal with the challenges. It combines locality-sensitive hashing (LSH), isolation forest, and PCA techniques. MDS_AD has the following properties. 1) The introduced LSH can operate on multiaspect data. 2) MDS_AD can effectively catch group anomalies from the experimental results. 3) The PCA is utilized to reduce dimensionality for correlations between different attributes. 4) MDS_AD is a streaming approach, which can perform model update and process data in constant memory and time. To confirm the performance of MDS_AD, multiple experiments are designed and implemented on UNSW-NB15 dataset. Experimental results show that MDS_AD outperforms state-of-the-art baselines.

Enhancing IIoT networks protection: A robust security model for attack detection in Internet Industrial Control Systems

Industrial Internet of Things (IIoT) networks involves heterogeneous technological and manufacturing services and devices. The communication and data exchange characteristics of IIoT systems and their associated networks make them susceptible to cyberattacks. Delivering IIoT systems with vigorous safety and speedy attack discovery is therefore vital. Intrusion detection systems (IDS) have been widely employed to detect cyber-attack events from Internet Industrial Control Systems (IICS) and their networks. Most recently, various attacks, such as flame, duqu and seismic attacks, against IICS setups have prompted excessive damage to nuclear and critical infrastructures in numerous countries. The existing intrusion detection methods generally lack sufficient generalization, misclassification errors and have high false alarm rates. To this end, this paper presents a deep-autoencoder based IDS to distinguish malicious actions from IIoT driven IICS networks in real-time. The proposed model is based on LSTM auto-encoder design to identify invasive events from the IICS networks. The experimental results of proposed IDS on two benchmark datasets, that is, the gas pipeline and UNSWNB-15 datasets demonstrates the superiority of proposed model as compared to other compelling ones by achieving accuracy rate of 97.95% and 97.62% for gas pipeline data and UNSW-NB15 dataset respectively.

Combined Ensemble Intrusion Detection Model using Deep learning with Feature Selection for Fog Computing Environments

Decentralized architecture known as fog computing is situated between the cloud and data-producing devices. It acts as a conduit between cloud services and IoT devices. In order to reduce latency, fog computing can handle a significant amount of computation for time-sensitive IoT applications. The Fog layer is simultaneously vulnerable to numerous assaults. To defend the fog nodes from attacks, fog computing paradigms may be suited for deep learning-based intrusion detection systems (IDS). In this paper, a combined Ensemble Intrusion Detection Model using Deep learning with Efficient Feature Selection using Random forests is proposed for Fog Computing Environments by using two deep learning models of traditional CNN and IDS-AlexNet model called Ensemble CNN-IDS with Random Forest and showed this model gives high accuracy of attack detection. The respective model implementations demonstrated on the UNSW-NB15 dataset that consists of 9 classes of attacks namely Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcodes and Worms. The proposed combined Ensemble Intrusion Detection Model using Deep learning with Efficient Feature Selection for intrusions detection is shown to be accurate and efficient by using different classifiers. Our proposed model provides high the accuracy in attack detection of about 97.5% that it outperformed various other traditional and recent models.

A Situation Awareness Approach for Network Security Using the Fusion Model

Aiming at the limited learning ability of a single model, the objective of this paper is to investigate situational awareness of the network security which is established on the fusion model. In this paper, a convolutional neural network (CNN) and long short-term memory (LSTM)-based model for situational assessment of the network security condition are provided. According to different fusion methods, the parallel and serial CNN-LSTM fusion models were constructed to evaluate the UNSW-NB15 data set, and both the situation values and levels were obtained. The investigational outcomes illustrate that the evaluation accuracy of the two models can reach up to 85.19% and 92.59%, respectively. A situation prediction model called IPSO-ABiLSTM is suggested and is based on improved particle swarm optimization (IPSO) and attention fusion bidirectional long short-term memory (ABiLSTM). The IPSO has the characteristics of faster convergence speed to optimize the ABiLSTM network parameters and obtain the optimal parameters for situation prediction. The investigational outcomes illustrate that the suggested IPSO-ABiLSTM model has a fitting degree of up to 0.9922, which can effectively achieve the situation prediction in the network security.

Network Intrusion Detection with 1D Convolutional Neural Networks

Computer network assets expose to various cyber threats in today’s digital era. Network Anomaly Detection Systems (NADS) play a vital role in protecting digital assets in the purview of network security. Intrusion detection systems data are imbalanced and high dimensioned, affecting models’ performance in classifying malicious traffic. This paper uses a denoising autoencoder (DAE) for feature selection to reduce data dimension. To balance the data, the authors use a combined approach of oversampling technique, adaptive synthetic (ADASYN) and a cluster-based under-sampling method using a clustering algorithm, Kmeans. Then, a one-dimensional convolutional neural network (1D-CNN) is used to perform classification. The performance of the proposed model is evaluated on UNSW-NB15 and NSL-KDD datasets. The experimental results show that the model produces a detection rate of 98.79% and 97.23% on UNSW-NB15 for binary classification and multiclass classification, respectively. In the evaluation using NSL-KDD, the model yields a detection rate of 98.52% for binary type classification and 98.16% for multiclass type classification.

A new intrusion detection system based on Moth–Flame Optimizer algorithm

This study relies on using a Moth–Flame Optimization (MFO) method as a search algorithm and a Decision Tree (DT) as an evaluation algorithm to generate an efficient feature subset for intrusion detection systems (IDS). The target is to find a feature subset using the minimum number of traffic network features that later obtains the maximum performance by the machine algorithms used in the classification task. This depends on enhancing the MFO by adopting new operators besides the embedded spiral operator to balance the exploration and exploitation alleviating the local minima problem. The main contribution of this work is the adoption of the cosine similarity measure to binarize the continuous MFO into a binary problem. Cosine similarity overcomes the limitations of the commonly used sigmoid function that depends on using a threshold value for conversion. However, cosine similarity computes the similarity ratio between the current solution and the optimal solution. The augmented MFO wrapper framework is applied as an IDS to detect anomalous traffic in the network. The proposed method is compared against several well-known state-of-the-art algorithms on three network datasets (KDDCUPP9, NSL-KDD, and UNSW-NB15), using IDSACC, IDSTPR, IDSFPR, IDSF-score, and convergence evaluation measures to assess the performance of the proposed method. The experimental results show the superiority of the proposed cosine similarity method compared to other algorithms with an accuracy of 97.8%, F-score of 99%, TPR of 99.6%, and FPR of 8.1% using only five selected features from the KDDCUPP99 dataset. It achieved the accuracy of 89.7%, TPR of 89.1%, FPR of 2.9%, when four selected features from the NSL-KDD dataset are used. And finally, it achieved an accuracy of 92.4%, TPR of 92.3%, FPR of 3%, and F-score 94.2% when the UNSW-NB15 dataset is used.