A distributed framework for supporting adaptive ensemble-based intrusion detection

This paper proposes an adaptive on-line intrusion detection model based on incremental rule learning. This model can make self-learning over the ever-emerged new network behavior examples and dynamically modify behavior profile of the model, which overcomes the disadvantage that the traditional static detecting model must relearn over all the old and new examples, even can't relearn because of limited memory size. The experiment results validate the feasibility and effectivity of the presented adaptive intrusion detection model.

Aiming at the shortcomings of current intrusion detection, a SOM neural network method based on clustering and network level is proposed in this paper. Through the identification of easy-to-use network intrusion type, the network intrusion data is cleaned and analyzed in a targeted manner and the multi-layer adaptive network intrusion detection clustering model is established. Network intrusion detection clustering result based on this model is compared with result based on other methods. The results show that this model has higher accuracy and equilibrium and the validity and feasibility of the method is further verified.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Chapter 5 - Intrusion Prevention and Detection Systems

In this paper, a new learning algorithm for adaptive network intrusion detection using naive Bayesian classifier and decision tree is presented, which performs balance detections and keeps false positives at acceptable level for different types of network attacks, and eliminates redundant attributes as well as contradictory examples from training data that make the detection model complex. The proposed algorithm also addresses some difficulties of data mining such as handling continuous attribute, dealing with missing attribute values, and reducing noise in training data. Due to the large volumes of security audit data as well as the complex and dynamic properties of intrusion behaviours, several data miningbased intrusion detection techniques have been applied to network-based traffic data and host-based data in the last decades. However, there remain various issues needed to be examined towards current intrusion detection systems (IDS). We tested the performance of our proposed algorithm with existing learning algorithms by employing on the KDD99 benchmark intrusion detection dataset. The experimental results prove that the proposed algorithm achieved high detection rates (DR) and significant reduce false positives (FP) for different types of network intrusions using limited computational resources.

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

There are considerable hurdles that must be overcome in order to maintain adequate security against cyber-attacks in cloud settings because of their dynamic and dispersed nature. A proactive method to identifying and mitigating new threats in real time is provided by adaptive intrusion detection systems (IDS) that make use of machine learning (ML). The design and operation of adaptive intrusion detection systems (IDS) that are adapted for cloud platforms are investigated in this study. Particular attention is paid to the utilisation of supervised, unsupervised, and reinforcement learning methods. It investigates the benefits of adaptive intrusion detection systems (IDS) in terms of identifying abnormal behaviours, minimising the number of false positives, and adapting to shifting threat environments. Several important factors, including the selection of features, the quality of the dataset, and the optimisation of the algorithm, are covered. In addition to this, we investigate the possibility of integrating adaptive intrusion detection systems with cloud-native technologies such as serverless computing and containers. Performance measurements and comparative evaluations demonstrate that machine learning-based intrusion detection systems are more effective than older techniques. Additionally, the study addresses issues such as scalability, data privacy, and adversarial assaults, and it proposes viable methods to improve dependability. The adaptive intrusion detection system (IDS) is an essential component of cloud security methods since it enables continuous monitoring and reaction to complex kinds of attacks.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

The recent rise in both the frequency and sophistication of cyberattacks in particular, those directed towards distributed and resource constrained, cyber physical environments justifies the need for timely, effective, and adaptive intrusion detection in IoT networks, particularly for lightweight, efficient IoT edge implementations. The work presented in this paper addresses the design of a lightweight, feature efficient intrusion detection system using the XGBoost machine learning algorithm. A classification model was trained on both signal and statistical based subsets of features extracted from a dataset, where the model learned to classify the network traffic data as either benign or malicious. A key aspect of the comparison was to separate the performance of the XGBoost model from the performance of ConvNeXT, which seemed to use an image-based approach to represent the network traffic. Results show that the XGBoost model was both accurate and precise, with higher recall and classification accuracy with less misclassification and ConvNeXT showed poor performance for both classes with class imbalance and a higher false negative rate than XGBoost. Results of this study demonstrate that tabular learning methods such as XGBoost can be effective solutions for both static and realtime intrusion detection for IoT environments in an efficient, applicable manner, with the capacity to be feasibly and scalable as an edge deployment without an overly complex processes to go through to transformation a data model.

Intrusion detection is a significant technique for detecting various attacks in Wireless Mesh Networks (WMNs). Intrusion Detection Systems (IDS) powered by machine learning algorithms play a vital role in enhancing security by actively monitoring data traffic in real-time. The performance of attack detection in IDS is reduced by the existence of noisy and unwanted features in the network data. Hence, extracting Informative Features (IF) is essential for enhancing the effectiveness of the IDS. The proposed approach optimally selects IF from the network dataset, which facilitates in accurately detecting intrusions. Existing methods lack in efficient feature selection, leading to higher computational complexity and lower detection performance. This research aims to enhance IDS accuracy by leveraging the eXtreme Gradient Boosting (XGBoost) algorithm to classify the intrusions in the mesh network of smart grid and the optimal feature selection carried out with the help of Golden Eagle Optimization Algorithm (GEOA). This novel hybrid IDS model enhances the attack detection in WMNs. The proposed IDS’s performance is improved by using a feature selection method based on the GEOA, and then obtained results are compared against evolutionary algorithms-based features selection method. The proposed model of IDS using XGBoost algorithm is tested on a smart grid dataset, and its performance is compared with existing literature works.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

With the rapid development of computer network and applications, attacks are becoming more and more complicated and elusive. The traditional intrusion detection systems have been unable to meet new security requirements. This paper proposes a collaborative intrusion detection model based on multi-agents. In this model, four kinds of agents are defined, which are organized in a hierarchical structure. The basic agents in every host or at the entrances of subnets are responsible for performing the simple detection and response tasks. The complicated collaboration task is executed by some separate coordination agents, which are responsible for synthetically analyzing the suspicious behavior that the lower-level agents are unable to identify. Coordination agents are also able to assign the task to the lower-level associated agents. Based on the hierarchical structure, the formal description of the model is given. By adaptive policies and dynamic association among some elements, this model provides dynamic adaptability to the changing environment and attacks. In addition, this paper also proposes the concept of coordination domain which facilitates the management of collaborative detection. The model lays a theoretical foundation for constructing dynamically adaptive intrusion detection system.

The increasing complexity of cyber threats targeting cloud infrastructures demands advanced and adaptive intrusion detection systems (IDS). This study explores the application of deep learning (DL) models—Convolutional Neural Networks (CNN), Long Short-Term Memory networks (LSTM), and a hybrid CNN+BiLSTM architecture—for detecting network intrusions using benchmark datasets CIC-IDS2017 and UNSW-NB15. This study contributes by demonstrating how hybrid CNN+BiLSTM architectures enhance intrusion detection accuracy on benchmark datasets, offering low latency and improved recall for rare attack classes, thereby validating their suitability for real-time cloud security deployment. Results show that hybrid CNN+BiLSTM models outperform standalone CNN and LSTM architectures in detection performance, achieving accuracies up to 97.4% on CIC-IDS2017 and 96.85% on UNSW-NB15, while maintaining acceptable latency for real-time deployment. The hybrid model also demonstrates superior F1-scores for rare attack classes and lower false positive rates. The discussion highlights the importance of dataset quality, feature engineering, and the role of adversarial training and model optimization in enhancing robustness. In conclusion, this work affirms the value of hybrid DL architectures for cloud-based IDS and suggests future directions in federated learning, adaptive retraining, and deployment in edge environments.

Nowadays, more and more devices are connected to the Internet, with enormous information transmitted on it. Malware spread through a local area network (LAN) can infect lots of internal users. A network intrusion detection system aims to safeguard a network from these malicious attacks. We proposed an efficient and adaptive intrusion measurement and detection approach based on protocol-wise associative memory of Hopfield networks, where the network traffic features related to several protocols including ARP, TCP, and UDP were stored. By evolving the neural network's energy state, we reconstructed a stored feature pattern from the input of novel network traffic. We evaluated the scheme using the recall and the divergence rate. At last, we achieved an average validation recall score of 0.9591 for detecting various malicious network events.