A hybrid web log based intrusion detection model

Integrated intrusion detection model based on artificial immune

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

In recent years, intelligent intrusion detection techniques based on machine learning have been the research spots in the field of intrusion detection. Whereas, as network traffic and network scale increase continually, some current machine learning algorithms can't meet the requirement of the network intrusion detection models for efficiency and accuracy, which restricts the application of machine learning into intrusion detection. In order to enhance the availability and practicality of intelligent intrusion detection system based on machine learning in high-speed network, an improved fast inductive learning method for intrusion detection (FILMID) is designed and implemented. Accordingly, an efficient intrusion detection model based on FILMID algorithm is presented. The experiment results on the standard testing dataset validate the effectiveness of the FILMID based intrusion detection model.

The increasing counterfeit of the internet usage has raised concerns of the security agencies to work very hard in order to diminish the presence of the abnormal users from the web. The motive of these illicit users (called intruders) is to harm the system or the network either by gaining access to the system or prohibiting genuine users to access the resources. Hence in order to tackle the abnormalities Intrusion Detection System (IDS) with Data Mining has evolved as the most demanding approach. On the one end IDS aims to detect the intrusions by monitoring a given environment while on the other end Data Mining allows mining of these intrusions hidden among genuine users. In this regard, IDS with Data Mining has been through several revisions in consideration to meet the current requirements with efficient detection of intrusions. Also several models have been proposed for enhancing the system performance. In context to improved performance, the paper presents a new model for intrusion detection. This improved model, named as REP (Reduced Error Pruning) based Intrusion Detection Model results in higher accuracy along with the increased number of correctly classified instances.

Most of the intrusion detection models (IDM) are constructed with off-line training data. Time-variance characteristic of the practical network system cannot be embodied in the off-line constructed IDM. On-line updating of the off-line IDM with the valued new samples is very necessary. In this paper, a new on-line instruction detection model based on approximate linear dependent (ALD) condition with linear latent feature extraction is proposed to address this problem. Specifically, the valued samples which can represent drift of the practical network are indentified with ALD and prior knowledge. Then, these selected samples are used to update the off-line IDM based on on-line latent feature extraction method and fast machine learning algorithm with sample-based updating strategy. Experiments based on KDD99 data are used to validate the proposed approach.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

With a paradigm shift to untact environments, security threats on the network also have been significantly increasing all over the world. To monitor and detect intrusion attempts under enormous network traffic, Security Operation Center (SOC) essentially exploits various security devices. Above all, Network Intrusion Detection System (NIDS) has been operated in public/private sectors as a spearhead to fight against cyber threats. In particular, state-of-the-art technologies, especially ML and AI, have been being studied to achieve quick and accurate intrusion detection. Despite much effort to guarantee a secure network, however, SOCs are still struggling for overcoming various types of threats as well as attacks of similar form with benign traffic. Even though the advanced techniques may find out a complex and unknown attack, operating and managing them in real-world situations cause counterproductively more pressure to agents in the SOC. In order to solve these difficulties, this study introduces an easy-to-use framework to build intrusion detection models based on AI techniques, as well as to operate them depending on a situation using a graphical user interface. The framework supports generating various types of AI- and ML-based intrusion detection models with optimized parameters by only a few steps. Furthermore, an interactive graphical interface makes it easier to manage detection models according to different threat situations. Finally, the performance of models made by the framework is evaluated in terms of accuracy, especially under the real-world SOC environment with live network traffic.

Uses of Artificial Intelligent Techniques to Build Accurate Models for Intrusion Detection System

At this stage, the high dimension and large variety of network data have increased the difficulty of intrusion detection. In this paper, we discuss the advantages and disadvantages of the MDBoost algorithm. Subsequently to optimize it, we add a slack variable in the objective function, so that the algorithm can effectively prevent over fitting, and the accuracy of the prediction is also improved. Then, we propose a model, which uses the MDBoost-2 algorithm to generate a strong classifier, and we use this model for intrusion detection. Finally, we use the CUP KDD 1999 data set to carry out the experiment. The results show that the new approach outperforms MDBoost and other well-known methods.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the "death" of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

Ensuring the safety and reliability of Transportation Cyber-Physical Systems (T-CPS) is critical. However, the increasing interconnectedness of T-CPS exposes them to sophisticated cyberattacks, necessitating robust intrusion detection systems (IDS) to safeguard against evolving threats. This paper aims to enhance the security of T-CPS by addressing two key challenges: effective anomaly detection and handling imbalanced datasets in intrusion detection tasks. In this paper, we propose ReMeNet (Reconstruction Memory Network), a novel intrusion detection model that combines a memory module with a GAN-based architecture to enhance anomaly detection and data reconstruction. To address the challenge of imbalanced datasets, we incorporate a Vector Quantized Wasserstein Generative Adversarial Network (VQ-WGAN) to generate additional samples for underrepresented attack categories, thereby balancing the dataset and improving detection performance. Experimental evaluation on the UNSW-NB15 dataset demonstrates that ReMeNet achieves an accuracy of 91.70%, and an F1-score of 91.63% which outperforms Random Forest by 8.02% and EC-GAN by 3.01%. The results show that ReMeNet effectively handles imbalanced data, improving detection rates across all attack categories in T-CPS.

Intrusion detection algorithms based on deep learning are currently a hot topic in the field of intrusion detection research, but most of the research focuses on how to improve the algorithms to improve the accuracy of intrusion detection, while ignoring the problem that the limited labeled data generated by a single organization is not enough to train a deep model with high accuracy in practice. The paper proposes a federal learning and convolutional neural network-based intrusion detection method that can expand the data volume by jointly training the model with data sets from multiple participants. The method uses a federation learning framework to design a deep learning-based intrusion detection model. The data dimensionality is first reconstructed by data padding to form two-dimensional data, then the DCNN network is used for feature extraction and learning under the mechanism of federation learning, and finally the model is trained with a softmax classifier for detection. In addition, aiming at the over-fitting problem caused by the compression and over-parameterization of deep neural networks, this paper proposes a model pruning method based on sparse convolutional neural network according to the weight parameters of the convolutional layer and the Batch Normalization layer (BN). This section will introduce the implementation details of this method. The experimental results show that this method largely reduces the training time and maintains a high detection rate. In addition, the model ensures data security and privacy compared to typical intrusion detection models.

Exponential growth of novel radical applications and services in sixth-generation (6G) networks is expected to increase the complexity of managing existing network infrastructures. In this context, the zero touch network and service management (ZSM) paradigm, which leverages AI, SDN, and NFV techniques, is seen as a promising solution to automatically manage and orchestrate network resources. However, due to the closed-loop operation and automated end-to-end framework in a distributed 6G network, the ZSM architecture, along with its potential benefits, is exposed to various security threats. A recently proposed solution to address privacy concerns is federated learning (FL), whereby distributed training is performed, and the aggregated model parameters, instead of clients' raw data, are forwarded to the global server. However, most of the existing FL and semi-supervised learning (SSL) models for intrusion detection are based on the assumption that fully labeled data are always available at the server and client sides, which is not practical due to the high labeling costs and privacy constraints in the 6G network. In this article, we propose a novel FL-empowered semi-supervised active learning (FL-SSAL) security orchestration framework for the Label-at-Client scenario where, along with unlabeled samples, clients have a small portion of labeled data. The entropy-based active learning selects the most informative samples for data annotation and leverages the unlabeled data using a semi-supervised approach. The results of our experimental evaluations performed on the private, not independent and identically distributed (non-IID) dataset demonstrate that FL-SSAL achieves higher intrusion detection accuracy and has less communication overhead than baseline schemes with less labeled data.

Network security is essential for both personal and business networks. Somewhat recently, the remarkable development of organization related administrations has brought about an enormous inundation of secret information on the web. Be that as it may, networks are exceptionally defenceless against unauthenticated interruptions. Current digital actual frameworks are getting progressively related. Such interdependencies make new weaknesses and make these frameworks more defenceless to disappointments. There are many cyber-attacks such as Denial of Service attack, Man in the Middle attack, SQL injections. The proposed system is intrusion detection system which detects for various failures and attacks in the given network data. It uses ML algorithm, for detection of the various attacks and provides the result as the same. The model has been evaluated on dataset collected through network simulations and various data collected from the online sources. The proposed system make sure the system is able to detect the intrusions effectively.KeywordsNetwork securityCyber-physical systemMachine learningNetwork attackIntrusion detection