8. 08102 Manifesto – Perspectives Workshop: Network Attack Detection and Defense

Intrusion Detection system becomes the one of the favorite research topic due to its capability of detecting various network attacks. There are many works done in the field of intrusion detection up till now. In this paper we are proposing the pattern based Intrusion Detection model. This system is based on CIDF architecture. The Pattern based Intrusion Detection model consist of five modules: Capture Module, Decode Module, Detection Module, Known Attack Pattern Module and Action Module. A pattern based IDS monitor packets on the network and compares them against a database of known attack pattern of malicious threats. Our paper focuses on the packet sniffer and its working, various attacks on network as an intrusion and their detection using pattern based IDS.

Despite the successful contributions in the field of network intrusion detection using machine learning algorithms and deep networks to learn the boundaries between normal traffic and network attacks, it is still challenging to detect various attacks with high performance. In this paper, we propose a novel mathematical model for further development of robust, reliable, and efficient software for practical intrusion detection applications. In this present work, we are concerned with optimal hyperparameters tuned for high performance sparse autoencoders for optimizing features and classifying normal and abnormal traffic patterns. The proposed framework allows the parameters of the back-propagation learning algorithm to be tuned with respect to the performance and architecture of the sparse autoencoder through a sequence of trigonometric simplex designs. These hyperparameters include the number of nodes in the hidden layer, learning rate of the hidden layer, and learning rate of the output layer. It is expected to achieve better results in extracting features and adapting to various levels of learning hierarchy as different layers of the autoencoder are characterized by different learning rates in the proposed framework. The idea is viewed such that every learning rate of a hidden layer is a dimension in a multidimensional space. Hence, a vector of the adaptive learning rates is implemented for the multiple layers of the network to accelerate the processing time that is required for the network to learn the mapping towards a combination of enhanced features and the optimal synaptic weights in the multiple layers for a given problem. The suggested framework is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyber-attacks. Experimental results demonstrate that the proposed architecture for intrusion detection yields superior performance compared to recently published algorithms in terms of classification accuracy and F-measure results.

Intrusion detection is an emerging area of research in the computer security and net-works with the growing usage of internet in everyday life. Most intrusion detection systems (IDSs) mostly use a single classifier algorithm to classify the network traffic data as normal behavior or anomalous. However, these single classifier systems fail to provide the best possible attack detection rate with low false alarm rate. In this paper,we propose to use a hybrid intelligent approach using a combination of classifiers in order to make the decision intelligently, so that the overall performance of the resul-tant model is enhanced. The general procedure in this is to follow the supervised or un-supervised data filtering with classifier or cluster first on the whole training dataset and then the output are applied to another classifier to classify the data. In this re- search, we applied Neural Network with Supervised and Unsupervised Learning in order to implement the intrusion detection system. Moreover, in this project, we used the method of Parallelization with real time application of the system processors to detect the systems intrusions.Using this method enhanced the speed of the intrusion detection. In order to train and test the neural network, NSLKDD database was used. Creating some different intrusion detection systems, each of which considered as a single agent, we precisely proceeded with the signature-based intrusion detection of the network.In the proposed design, the attacks have been classified into 4 groups and each group is detected by an Agent equipped with intrusion detection system (IDS).These agents act independently and report the intrusion or non-intrusion in the system; the results achieved by the agents will be studied in the Final Analyst and at last the analyst reports that whether there has been an intrusion in the system or not. Keywords: Intrusion Detection, Multi-layer Perceptron, False Positives, Signature- based intrusion detection, Decision tree, Nave Bayes Classifier

In recent years, intelligent intrusion detection techniques based on machine learning have been the research spots in the field of intrusion detection. Whereas, as network traffic and network scale increase continually, some current machine learning algorithms can't meet the requirement of the network intrusion detection models for efficiency and accuracy, which restricts the application of machine learning into intrusion detection. In order to enhance the availability and practicality of intelligent intrusion detection system based on machine learning in high-speed network, an improved fast inductive learning method for intrusion detection (FILMID) is designed and implemented. Accordingly, an efficient intrusion detection model based on FILMID algorithm is presented. The experiment results on the standard testing dataset validate the effectiveness of the FILMID based intrusion detection model.

In this paper, by combining the known deep learning related literature in the field of intrusion detection, and the existing in the design of intrusion detection system based on the deep learning common low detection efficiency and high rate of false positives, as well as the training data set used by the problems of unbalanced data, etc., through the depth study of feature extraction and data processing ability. To study the intrusion detection method of the Internet of Things based on deep learning. The work and achievements are as follows:First of all, will be used for feature selection embedded model (EM) and used in intrusion detection of the convolution neural network (CNN), combined with lightweight intrusion detection model (XCNN), because it is an embedded model (EM), so can reduce the impact on the equipment, at the same time compared with other algorithms, the computing time is shorter, the same or even better.Second, proposed to the Attention mechanism (Self - Attention) is applied to intrusion detection system, due to the nature of the Attention mechanism, the mechanism and long Attention can greatly reduce the training time, through introducing the residual network, application feature coding technique again the sparse features thickened into low density at high altitudes, and join to its relative position encoding, So it can sense global information and solve the long-term dependence problem of recurrent neural network.Finally, the results of the intrusion detection method were analyzed on the Pthon simulation platform, and the relevant indicators were verified by using THE NSL-KDD dataset, THE CIC-IDS2017 dataset and the CSE-CIC-IDS2018 dataset. The effectiveness of the method was proved by building a laboratory Internet of Things environment for actual testing. The experimental results show that the algorithm can greatly reduce training time, improve training efficiency, and have the same or even better performance results.

In the detection process of server network storm attack, the traditional method takes the signal detection algorithm, because the attack number is large, the detection error is big.According to the problem, an improved server network storm attack detection method is proposed based on improved density clustering algorithm, the server network storm attack detection problem is transformed into a multi class classification problem, wrapper features selection model is taken, IDBC network connection record distance calculation method is combined, based on DBSCAN clustering results, the data clustering and attack detection is obtained.Simulation results show that, the improved density clustering algorithm is applied in detection of server network storm attack, it can reduce the detection error, the performance of the detection system is improved.

The sensor nodes of wireless sensor networks (WSNs) are deployed to an open and unsupervised region, and they are vulnerable to various types of attacks. Intrusion detection system can detect network attacks that nodes suffer from. This paper combines improved particle swarm optimisation (IPSO) algorithm and back-propagation neural network (BPNN), named IPSO-BPNN. We propose an intrusion detection model of WSNs based on a hierarchical structure. First, we use IPSO algorithm to optimise the initial parameters of BPNN to avoid falling into the local optimum. Then, we apply IPSO-BPNN to the intrusion detection of WSNs. Finally, we use benchmark NSL-KDD and UNSW-NB15 datasets to verify the performance of the IPSO-BPNN. The simulation results show that IPSO-BPNN has faster convergence speed, higher detection accuracy rate and lower false positive rate compared with BPNN and BPNN optimised by PSO algorithm, which can meet the WSNs intrusion detection requirements.

The complexity of the Internet and the volume of network traffic have dramatically increased in the last few years, making it more challenging to design scalable Network Traffic Monitoring and Analysis (NTMA) systems. Critical NTMA applications such as the detection of network attacks and anomalies require fast mechanisms for on-line analysis of thousands of events per second, as well as efficient techniques for off-line analysis of massive historical data. The high-dimensionality of network data provided by current network monitoring systems opens the door to the massive application of machine learning approaches to improve the detection and classification of network attacks and anomalies, but this higher dimensionality comes with an extra data processing overhead. In this paper we present Big-DAMA, a big data analytics framework (BDAF) for NTMA applications. Big-DAMA is a flexible BDAF, capable to analyze and store big amounts of both structured and unstructured heterogeneous data sources, with both stream and batch processing capabilities. Big-DAMA uses off-the-shelf big data storage and processing engines to offer both stream data processing and batch processing capabilities, decomposing separate engines for stream, batch and query, following a Data Stream Warehouse (DSW) paradigm. Big-DAMA implements several algorithms for anomaly detection and network security using supervised and unsupervised machine learning (ML) models, using off-the-shelf ML libraries. We apply Big-DAMA to the detection of different types of network attacks and anomalies, benchmarking multiple supervised ML models. Evaluations are conducted on top of real network measurements collected at the WIDE backbone network, using the well-known MAWILab dataset for attacks labeling. Big-DAMA can speed up computations by a factor of 10 when compared to a standard Apache Spark cluster, and can be easily deployed in cloud environments, using hardware virtualization technology.

This paper describes literature works in intrusion detection field. After that, we propose an intrusion detection method in Linux/Unix commands using supervisor synthesis. This method was applied to distinct normal user behavior from intruders behavior. The main features of this work are twofold. It exploits supervisor synthesis in the intrusion detection field. It presents our approach by behavior specification. Two advantages characterize our proposed algorithm for detection. The first advantage is that the algorithm result is a structure. The second advantage is the way of searching faults or intrusions.

Information system is vital for any company. However, the opening to the outside world makes the computer system more vulnerable to attack. It is essential to protect it. Intrusion Detection System (IDS) is an auditing mechanism that analyzes the traffic system and applications to identify normal use of the system and an intrusion attempt and also it prevent security managers. Despite the advantages of IDS, they suffer from a few problems. The major problem in the field of intrusion detection is the classification problem. Genetic Fuzzy System (GFS) are models capable of integrating accuracy and high comprehensibility in their results. They have been widely employed to solve classification problems. In this paper, we use a new GFS model called Genetic Programming Fuzzy Inference System for Classification (GPFIS-Class). It based on Multi-Gene Genetic Programming (MGGP). This model is not used in the intrusion detection area. We use an efficient feature selection method to eliminate data redundancy and irrelevant features in order to analyze the huge data namely the NSL-KDD data set.

In recent years, machine learning technology has been widely used for timely network attack detection and classification. However, due to the large number of network traffic and the complex and variable nature of malicious attacks, many challenges have arisen in the field of network intrusion detection. Aiming at the problem that massive and high-dimensional data in cloud computing networks will have a negative impact on anomaly detection, this paper proposes a Bi-LSTM method based on attention mechanism, which learns by transmitting IDS data to multiple hidden layers. Abstract information and high-dimensional feature representation in network data messages are used to improve the accuracy of intrusion detection. In the experiment, we use the public data set KDD-Cup 99 for verification. The experimental results show that the model can effectively detect unpredictable malicious behaviors under the current network environment, improve detection accuracy and reduce false positive rate compared with traditional intrusion detection methods.

The smart grid is vulnerable to network attacks, thus requiring a high detection rate and fast detection speed for intrusion detection systems. With a fast training speed and a strong model generalization ability, the extreme learning machine (ELM) perfectly meets the needs of intrusion detection of the smart grid. In this paper, the ELM is applied to the field of smart grid intrusion detection. Aiming at the problem that the randomness of input weights and hidden layer bias in the ELM cannot guarantee the optimal performance of the ELM intrusion detection model, a genetic algorithm (GA)-ELM algorithm based on a genetic algorithm (GA) is proposed. GA is used to optimize the input weight and hidden layer bias of the ELM. Firstly, the input weight and hidden layer bias of the ELM are mapped to the chromosome vector of a GA, and the test error of the ELM model is set as the fitness function of the GA. Then, the parameters of the ELM intrusion detection model are optimized by genetic operation; the input weight and bias, corresponding to the minimum test error, are selected to improve the performance of the ELM model. Compared with the ELM and online sequential extreme learning machine (OS-ELM), the GA-ELM effectively improves the accuracy, detection rate and precision of intrusion detection and reduces the false positive rate and missing report rate.

Now a days cyber crime growing and has a big effect everywhere globally. ethical hackers are normally involved in identifying flaws and recommending mitigation measures. the cyber safety international, there's a pressing need for the improvement of powerful techniques. Because of the effectiveness of machine learning in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber security, machine learning approaches have been utilized to handle important concerns such as intrusion detection, malware classification and detection, spam detection, and phishing detection. Although ML cannot fully automate a cyber-security system, it can identify cyber-security threats more efficiently than other software-oriented approaches, relieving security analysts of their burden. As a result, effective adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks is fundamentally different from those of these other applications, making it substantially more difficult for the intrusion detection community to apply machine learning effectively. In this study, the CPS is modeled as a network of agents that move in unison with one another, with one agent acting as a leader and commanding the other agents. The proposed strategy in this study is to employ the structure of deep neural networks for the detection phase, which should tell the system of the attack's existence in the early stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent in the leader-follower mechanism has been researched. Following the attack detection phase with a deep neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the presented control method. Experiment results show that deep learning algorithms can detect attacks more effectively than traditional methods, making cyber security simpler, more proactive, and less expensive and more expensive.

Intrusion detection systems play an important role in preventing attacks which have been increased rapidly due to the dependence on network and Internet connectivity. Deep learning algorithms are promising techniques, which have been used in many classification problems. In the same way, multi-agent systems become a new useful approach in intrusion detection field. In this paper, we propose a deep learning-based multi-agent system for intrusion detection which combines the desired features of multi-agent system approach with the precision of deep learning algorithms. Therefore, we created a number of autonomous, intelligent and adaptive agents that implanted three algorithms, namely autoencoder, multilayer perceptron and k-nearest neighbors. Autoencoder is used as features reduction tool, and multilayer perceptron and k-nearest neighbors are used as classifiers. The performance of our model is compared against traditional machine learning approaches and other multi-agent system-based systems. The experiments have shown that our hybrid distributed intrusion detection system achieves the detection with better accuracy rate and it reduces considerably the time of detection.

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.