A hybrid intrusion detection system

With the enlarged utilization of computer networks, security has become one of the critical issues. A network intrusion by malicious or unauthorized consumers may cause severe interruption to networks. So, the progress of a strong and dependable network intrusion detection system (IDS) is gradually significant. Intrusion detection relates to a suite of models employed to recognize attacks against network infrastructures and computers. There are dual main intrusion detection models, such as misuse and anomaly detection. Anomaly detection is a central part of intrusion detection in which disruptions of normal behaviour propose the presence of unintentionally or intentionally induced attacks, defects, faults, etc. With the arrival of anomaly-based IDS, many models have progressed in tracking new threats to the systems. Machine learning (ML) and deep learning (DL) models are currently leveraged for anomaly intrusion detection in cybersecurity. This manuscript proposes an Enhanced Anomaly Intrusion Detection using an Optimization Algorithm with Dimensionality Reduction and Hybrid Model (EAID-OADRHM) technique. The proposed EAID-OADRHM technique presents a new approach for perceiving and migrating attacks in cybersecurity. Min–max scaling normalization is primarily employed at the data pre-processing level to clean and transform input data into a consistent range. Furthermore, the proposed EAID-OADRHM technique utilizes the equilibrium optimizer (EO) model for the dimensionality reduction process. Additionally, the classification is performed by employing the long short-term memory and autoencoder (LSTM–AE) model. Finally, the improved Snow Ablation Optimizer (ISAO) model optimally tunes the hyperparameters of the LSTM–AE model, leading to enhanced classification performance. The simulation validation of the EAID-OADRHM approach is examined under the CIC-IDS2017 dataset, and the outcomes are computed using numerous measures. The experimental assessment of the EAID-OADRHM approach portrayed a superior accuracy value of 99.46% over existing methods in the anomaly intrusion detection process.

Classical intrusion detection system tends to identify attacks by using a set of rules known as signatures defined before the attack, this kind of detection is known as misuse intrusion detection. But reality is not always quantifiable, and this drives us to a new intrusion detection technique known as anomaly intrusion detection, due to the difficulties of defining normal pattern for random data frames, anomaly detection suffer from false positives, where normal traffic behavior is mistaken and classified as an attack and cause a great deal of manpower to manual sort the attacks. In this paper we construct a network based anomaly intrusion detection system using naive Bayes as weak learners enhanced with AdaBoost (Adaptive Boosing machine learning algorithm), experiment using KDD '99 cup data proved that our IDS can achieve extremely low False Positive and has acceptable detection rate.

The rapid increasing of security incidents imposes a great burden on Internet users and system administrators. In this paper we discuss a parallel analysis for lightweight network incident detection using nonlinear adaptive systems. We run AID (anomaly intrusion detection) and MID (misuse intrusion detection) systems in parallel. Two detectors generate binary output misuse = {YES/NO} and anomaly = {YES/NO}. Then, we can determine whether we need to perform network or security operation. We apply clustering algorithm for AID and classification algorithm for MID. The nonlinear adaptive system is trained for running MID and AID in parallel. Proposed parallel system is more lightweight and simple to operate even if the number of incident patterns is increased. Experimental results in the case where false positive is frequently caused show that our method is functional with a recognition rate of attacks less than 10%, while finding the anomaly status. Also, performance evaluation show that proposed system can work with reasonable CPU utilization compared with conventional serial search based system.

컴퓨터 네트워크의 확대 및 인터넷 이용의 급격한 증가에 따른 최근의 정보통신 기반구조는 컴퓨터 시스템의 네트워크를 통한 연결로 다양한 서비스를 제공하고 있다. 특히 인터넷은 개방형 구조를 가지고 있어 서비스 품질의 보장과 네트워크의 관리가 어렵고, 기반구조의 취약성으로 인하여 타인으로부터의 해킹 및 정보유출 둥의 위협으로부터 노출되어 있다. 보안 위협에 대한 능동적인 대처 및 침입 이후에 동일한 또는 유사한 유형의 사건 발생에 대해 실시간 대응할 수 있는 방법이 중요하게 되었으며 이러한 해결책으로서 침임 탐지 시스템에 대한 연구가 활발히 진행되고 있다. 본 논문에서는 지도학습 알고리즘이 의한 침입탐지 시스템의 성능을 향상시키기 위해서 불확실성을 해결하기 위한 방법인 퍼지를 적용한 뉴로-퍼지 모델의 이상 침입 탐지 시스템에 대해서 연구한다. 즉, 신경망 학습의 전달함수를 불확실성을 해결하기 위한 퍼지 멤버쉽 함수로 수정하여 지도학습을 수행하였다. 제안한 뉴로-퍼지기법을 DARPA 침입 데이터를 이용하여 오용 탐지의 한계성을 극복한 네트워크기반의 이상침입 탐지에 적용하여 성능을 검증하였다. By the help of expansion of computer network and rapid growth of Internet, the information infrastructure is now able to provide a wide range of services. Especially open architecture - the inherent nature of Internet - has not only got in the way of offering QoS service, managing networks, but also made the users vulnerable to both the threat of backing and the issue of information leak. Thus, people recognized the importance of both taking active, prompt and real-time action against intrusion threat, and at the same time, analyzing the similar patterns of in-trusion already known. There are now many researches underway on Intrusion Detection System(IDS). The paper carries research on the in-trusion detection system which hired supervised learning algorithm and Fuzzy membership function especially with Neuro-Fuzzy model in order to improve its performance. It modifies tansigmoid transfer function of Neural Networks into fuzzy membership function, so that it can reduce the uncertainty of anomaly intrusion detection. Finally, the fuzzy logic suggested here has been applied to a network-based anomaly intrusion detection system, tested against intrusion data offered by DARPA 2000 Intrusion Data Sets, and proven that it overcomes the shortcomings that Anomaly Intrusion Detection usually has.

In the paper we discuss the intergration of an support vector machine (SVM) based anomaly detection system with an specification based intrusion detection system (IDS), where the specification based IDS improves the feature-selection function of the SVMs. We demonstrate through experimental results, that extended finite state machine (EFSA) based anomaly detectors performs better than either the EFSA and SVM anomaly detectors individually. Specifically the accuracy of detection improved and the time and space required for SVM learning reduced using the feature reduction based on EFSAs.

With the spread of internet, the applications based on Internet are developing fast. However, it is generally accepted that internet security plays an increasing important role in our information society. As a significant measure, intrusion detection technique seems necessary. The traditional Intrusion Detection System has a high leaking and false alarm rate. We propose a new model based on Kernel Principal Component Analysis and Weight Particle Swarm Optimization-Support Vector Machine in this paper. The Kernel Principal Component Analysis method can be used in extracting the feature of nonlinear datasets, in order to reduce dimension. The Weight Particle Swarm Optimization helps to optimize the parameters in the Support Vector Machine. In the result, the model in this paper has a good performance.

Computer network defense (CND) protects organizations and individuals against cyber threats by monitoring, identifying, analyzing, and defending network infrastructure from infiltration. Network defenders must maintain high levels of cyber situation awareness (CSA) in order to correctly identify and act on threats to the network. Intrusion detection systems (IDSs) are automated systems designed to assist network defenders in building CSA by sifting through network traffic and flagging potential threats. These systems are plagued by high false alarm rates that inhibit the ability of network defenders to build CSA. More capable IDSs have been developed that are capable of increasing the hit rate and lowering the false alarm rate by analyzing gathered network information. The influence of these IDS technologies on CSA has yet to be explored. 172 San Jose State University psychology students performed a signal detection task for intrusion detection to examine whether integrated automation with a multilayered analysis incorporating both liberal and conservative response criteria leads to better CSA than less-integrated, yet liberally responding automation (high hit rates and high false alarm rates) or conservatively responding automation (with low hit rates and low false alarm rates). The IDS condition was manipulated at three levels (liberal, conservative, both). The reliability of the IDSs was manipulated at three levels (60%, 80%, 95%). This study was unable to observe any differences in task performance or CSA for any of the conditions.

With the industrial revolution 4.0, the use of IoT-based systems is increasing, both in the field of health manufacturing, urban planning, housing, and even automotive. Therefore, the security of the IoT system needs to be considered, this is related to data integrity, privacy, service stability. Through intrusion detection, activities on the IoT system will be able to be analyzed whether there are suspicious activities that can interfere with or threaten IoT services. In several previous studies in the literature, the approach used to detect intrusions in the IoT system has a high false alarm rate. This research proposes an approach through machine learning, specifically the ensemble learning approach and the synthetic minority over-sampling technique (SMOTE) method as a method of detecting intrusions in the IoT system which is expected to produce better performance. The results of this study indicate that the proposed approach is able to detect intrusion and classify into five types of intrusion including normal intrusion, probe, dos, r2l, u2r. Based on the evaluation results, the proposed approach can improve the performance of intrusion detection in terms of accuracy to 97.02%, detection rate of 97%, false alarm rate 0.16%, compared to base learning and approaches in previous studies used as intrusion detection methods, but in processing time performance have not shown satisfying results.

Hybrid optimization enabled deep learning technique for multi-level intrusion detection

Intrusion detection averts a network from probable intrusions by inspecting network traffic to ensure its integrity, availability, and confidentiality. Though IDS seems to eliminate malicious traffic, intruders have endeavored to use different approaches for undertaking attacks. Hence, effective intrusion detection is vital to detect attacks. Concurrently, the evolvement of machine learning (ML), attacks could be identified by evaluating the patterns and learning from them. Considering this, conventional works have attempted to perform intrusion detection. Nevertheless, they lacked about high false alarm rate (FAR) and low accuracy rate due to inefficient feature selection. To resolve these existing pitfalls, this research proposed a modified whale algorithm (MWA) based on nonlinear information gain to select significant and relevant features. This algorithm assures huge initialization to improve local search ability as the agent’s positions are usually near the optimal solution. It is also utilized for an adaptive search for an optimal combination of features. Following this, the research proposes Morlet particle swarm optimization hyperparameter optimization (MPSO-HO) to improve the convergence rate of the algorithm by consenting it to produce from the local optimization by improving its capability. Standard metrics assess the proposed system to confirm the optimal performance of the proposed system. Outcomes explore the effective ability of the proposed system in intrusion detection.

To improve the anomaly intrusion detection capability of the network, a multi kernel correlation vector machine (RVM) intrusion detection method based on fruit fly optimization algorithm (FOA) is proposed. In this method, the FOA algorithm is used to optimize the mixed kernel function parameters of the multi kernel RVM and establish an anomaly intrusion detection model for the network. Simulation result shows that using this method to construct intrusion detection models is easy to understand, easy to implement, and has high accuracy. Overall, it outperforms the RVM modeling method with a single kernel function in various accuracy indicators.

Computer networks are being attacked every day. Intrusion detection systems (IDS) are used to detect and reduce effects of these attacks. The currently used of hybrid intrusion detection systems that was base on signature and anomaly based detection techniques were became inefficient for detecting attacks because it have nearly less than or equal to 95.5% for the detection rate and 1.8% for false positive rate, nowadays these values are unsatisfied for the detection so that the needs to enhanced hybrid intrusion detection system has became the most important issues. In this study, the enhanced hybrid intrusion detection system has been proposed to provide better results with high accuracy of the detection rate and reduce the value of false positive rate that will done by proposing new method based on decision tree of data mining techniques that is based on C4.5 algorithm to show that the proposed model is more efficient and it gives better optimum results.

OLAP pre-aggregation techniques have proven to enable query time responses close to real-time in business and sta- tistical applications. In raster image databases (such as for geo services), similar data structures and operations appear. However, only one particular, comparatively sim- ple pre-aggregation technique is used there, namely image pyramids. We are working on systematically carrying over results from OLAP to geo raster databases. In this paper we identify a set of fundamental geo raster operations and formulate them algebraically, using a proven array model. We argue that pre-aggregation support for a few basic query patterns is sufficient for many practical situations.

Intrusion Detection Systems (IDS) play an important role in identifying possible attacks to the networks. Most algorithms create a model; and the classification is done based on that model. During the classification, one of the main concerns is increasing the accuracy and the reliability. Traditional intrusion detection methods have some problems such as high false alarm rate, low detection compatibility against the new attacks, and insufficient capacity of the analysis. The next issue related to the intrusion detection systems is the feature reduction, extraction, and selection. In this paper, an intrusion detection model was created by genetic algorithms (GA) and the construction of the classifying models based on the training data observed from the genetic algorithm by KNN (K-Nearest Neighbors) algorithm has been taken into consideration. In this algorithm, it is supposed to reduce the false alarm rate in comparison with the previous methods.

Cloud computing helps users to store and retrieve their data in the cloud online on an as-per-pay basis anytime, anywhere in the world. As a consequence, the security of data stored in the cloud serves as a key concern for cloud consumers due to ongoing hacking incidents in the cloud. Both cloud service providers (CSPs) and consumers face various attacks that pose a serious threat to both the organization and the user. Therefore, a robust intrusion detection system (IDS) needs to be configured to identify and avoid potential attacks in the cloud at an earlier stage. The state-of-the-art IDS system which used shallow machine learning techniques suffered from poor accuracy with a higher false alarm rate and higher response time. To overcome this problem, a hybrid semantic deep learning (HSDL) architecture is developed in this paper by integrating the long short-term memory (LSTM), convolutional neural network (CNN), and support vector machine (SVM) architectures. The semantic information present in the network traffic is identified using a semantic layer known as the Word2Vec embedding layer. The HSDL model classifies the intrusion present in the text along with its corresponding attack class. The normal text without any trace of intrusion is encrypted using an advanced encryption standard (AES) algorithm to enhance cloud storage security, and the optimal key with the largest key breaking time for the AES algorithm is selected using the crossover-based mine blast optimization algorithm (CMBA). The proposed HSDL scheme is evaluated and tested using two real-time intrusion detection benchmark datasets, namely NSL-KDD and UNSW-NB15. The proposed model achieves an accuracy of 99.98% for the NSL-KDD and 98.47% for the UNSW-NB15 dataset, respectively. The experimental and security analysis conducted proves the efficiency and robustness of the proposed scheme.