A new model of self-adaptive network intrusion detection

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

The Negative Selection (NS) algorithm is the first algorithm to come from the study of natural immune systems, and is the most widely known and applied algorithm in the field. It has been used to build intrusion detection systems along with many other security-related tasks. However, it has not been possible to use the Negative Selection algorithm on many real-world scenarios. The present research shows an optimization of the negative selection algorithm to make its execution faster. The optimized algorithm remains functionally the same, providing the same results as the unoptimized algorithm. Details are given about the optimization scheme used and the optimized negative selection algorithm is tested on the UCI Breast Cancer data set. The performance of the unoptimized negative selection algorithm is compared to the performance of the algorithm with the proposed optimization. Three claims about the function of the optimized negative selection algorithm are made and tested with four experiments. The results of the experiments are used to demonstrate that the algorithm is faster and does not change the negative selection algorithm or lower its accuracy. Although there has been research into the optimization of the Negative Selection algorithm, this work will only apply to hyper-sphere detectors, which has not been done before.

Recently, machine learning methodologies are playing an important role in detecting network intrusions (or attacks), which further helps the network administrator to take precautionary measures for preventing intrusions. In this project report, the authors propose to use various techniques like support vector machine, logistic regression, random forest, decision tree, and a hybrid model using artificial neural networks and random forest. The new hybrid model for network intrusion detection aims to achieve better precision, recall, accuracy, and F1 score. To reify this, combined artificial neural network and random forest algorithms are used. In the hybrid model, ANN works as a feature extractor and random forest as a classifier. The data is provided to ANN and the ANN generates new features on the basis of given input. The new features are then provided to random forest as an input. The random forest then classifies the data into different classes on the basis of new data. Here, KddCup99 dataset has been used to evaluate the models and accuracy achieved in each model.

Effective network intrusion detection using anomaly scores from unsupervised machine learning models depends on the performance of the models. Although unsupervised models do not require labels during the training and testing phases, the assessment of their performance metrics during the evaluation phase still requires comparing anomaly scores against labels. In real-world scenarios, the absence of labels in massive network datasets makes it infeasible to calculate performance metrics. Therefore, it is valuable to develop an algorithm that calculates robust performance metrics without using labels. In this paper, we propose a novel algorithm, Expectation Maximization-Area Under the Curve (EM-AUC), to derive the Area Under the ROC Curve (AUC-ROC) and the Area Under the Precision-Recall Curve (AUC-PR) by treating the unavailable labels as missing data and replacing them through their posterior probabilities. This algorithm was applied to two network intrusion datasets, yielding robust results. To the best of our knowledge, this is the first time AUC-ROC and AUC-PR, derived without labels, have been used to evaluate network intrusion detection systems. The EM-AUC algorithm enables model training, testing, and performance evaluation to proceed without comprehensive labels, offering a cost-effective and scalable solution for selecting the most effective models for network intrusion detection.

The rise of sophisticated cyber threats, such as malware and network intrusions, necessitates the use of Artificial Intelligence (AI) for efficient and accurate detection. However, traditional AI models often operate as black boxes, leaving security analysts without insights into the reasoning behind critical decisions. Explainable AI (XAI) addresses this challenge by providing interpretability and transparency in AI-driven cybersecurity solutions. This paper explores the role of XAI in malware analysis and network intrusion detection, highlighting how interpretable models enhance trust, improve decision-making, and facilitate regulatory compliance. It examines state-of-the-art XAI techniques, including Shapley Additive Explanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), and rule-based systems, for their application in identifying malicious software and detecting network anomalies. Furthermore, the paper discusses challenges, such as computational overhead and scalability, while presenting future directions for integrating XAI in real-time and hybrid security frameworks. By advancing the adoption of interpretable AI, cybersecurity systems can achieve greater effectiveness and reliability, addressing both technical and organizational needs in combating evolving cyber threats.

The ever-growing security challenges have been a hindrance to the success of Information Technology Innovations due to multifaceted network intrusions. Hence, it becomes imperative to provide tools that can address without compromising integrity, confidentiality and availability of network resources. This paper presents a model for detecting intrusion in a network using Negative Selection Algorithm. Negative Selection which is Human Immune System (HIS) inspired has been used for anomaly detection due to its self-non-self-discrimination potential. However, it suffers from high rate of false positives and scalability issues. This paper addresses the issues using feature selection to reduce the dimensionality of the dataset. The intrusion detection model is evaluated using NSL-KDD dataset. The results obtained using the benchmark dataset showed that the scalability issue reduced in the proposed approach.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the "death" of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

Due to the advantage of negative selection algorithm (NSA) in classification domain, this paper proposes an intrusion detection model named as wireless sensor networks (WSN-NSA) based on an improved V-detector algorithm for WSN. To overcome the problem of resource constraints of storage space, computing capacity and energy in WSN, the main strategy of the WSN-NSA is to establish a three level detection mechanism by taking the advantage of the cooperation of the base station, detection nodes, and ordinary nodes considering their different capabilities, and to modify the V-detector algorithm by modifying the detector generation rule and optimizing the detectors, and to use the principal component analysis to reduce the detection features. Two kinds of detectors sets which are memory detector set and mature detector set are used to detect the intrusion. The simulation results show that the proposed model outperforms the intrusion detection systems using the V-detector in the reduction of data storage space and computation, the increased detection rate, and the quick response to the secondary attack.

Early detection of threats to electrical energy distribution systems helps professionals make decisions and mitigate interruptions in supply and improper activation of the protection system. Biologically inspired methods, e.g., artificial neural networks, genetic algorithms, and ant colonies, solve optimization problems and facilitate pattern recognition and decision-making. The present work presents a tool for detecting and classifying voltage disturbances based on the negative selection algorithm, which identifies and eliminates self-reactive cells, associated with multiresolution analysis, which analyzes the signal at different scales of detail, allowing a more complete understanding and detailed description of the phenomenon in question. The negative wavelet selection algorithm demonstrates robustness to detect and classify disturbances.

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.

Traditional firewalls and data encryption techniques can no longer match the demands of current IoT network security due to the rising amount and variety of network threats. In order to manage IoT network risks, intrusion detection solutions have been advised. Even though machine learning (ML) helps the widely used intrusion detection techniques currently in use, these algorithms struggle with low detection rates and the requirement for extensive feature engineering. The deep learning model for IoT network intrusion detection is a method for traffic anomaly detection that is suggested by this study. To extract the sequence properties of data flow through a CNN, it combines an attention mechanism with a Long Short Term Memory (LSTM) network. This method uses adaptive synthetic sampling (ADASYN) to increase the size of minority-class samples. The proposed models demonstrated acceptable precision and recall for each class when used for binary-class classification, proving their stability and capacity to identify all classes correctly. The MLP classifier’s accuracy, precision, recall, and F1 value were 87%, 89%, 87%, and 89%, respectively, with an AUC score of 0.88. Overall, the proposed models performed well. The attack and all-class models exhibited good AUCs and macro metrics, the same as the proposed MLP classifier, which had an F1 score of 83% and an AUC score of 0.94. Additionally, it trained the MLP classifier and integrated the ADAM optimizer and category cross-entropy loss function for all-class classification. With an AUC value of 94%, it possessed 84% accuracy, 87% precision, 84% recall, and an 83% F1 score. A further indication of the hybrid model’s ability to combine the benefits of both models to improve overall performance was that it regularly outperformed the MLP model. This model’s accuracy and F1 score are better than those of earlier comparable algorithms, according to experimental results using the publicly accessible benchmark dataset for network intrusion detection (NSL–KDD).

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

Most of the intrusion detection models (IDM) are constructed with off-line training data. Time-variance characteristic of the practical network system cannot be embodied in the off-line constructed IDM. On-line updating of the off-line IDM with the valued new samples is very necessary. In this paper, a new on-line instruction detection model based on approximate linear dependent (ALD) condition with linear latent feature extraction is proposed to address this problem. Specifically, the valued samples which can represent drift of the practical network are indentified with ALD and prior knowledge. Then, these selected samples are used to update the off-line IDM based on on-line latent feature extraction method and fast machine learning algorithm with sample-based updating strategy. Experiments based on KDD99 data are used to validate the proposed approach.

Due to a rapid growth of Internet, the number of network attacks has risen leading to the essentials of network intrusion detection systems (IDS) to secure the network. With heterogeneous accesses and huge traffic volumes, several pattern identification techniques have been brought into the research community. Data Mining is one of the analyses which many IDSs have adopted as an attack recognition scheme. Thus, in this paper, the classification methodology including attribute and data selections was drawn based on the well-known classification schemes, i.e., Decision Tree, Ripper Rule, Neural Networks, Naïve Bayes, k-Nearest-Neighbour, and Support Vector Machine, for intrusion detection analysis using both KDD CUP dataset and recent HTTP BOTNET attacks. Performance of the evaluation was measured using recent Weka tools with a standard cross-validation and confusion matrix.

Intrusion Detection Systems (IDS) play a vital role in monitoring and preventing unauthorized access within critical network infrastructures. However, current IDS approaches often suffer from limitations in detection accuracy, scalability, and adaptability to evolving threats. To address these challenges, this study proposes an optimized Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) model for network-based intrusion detection. The model is specifically designed to capture temporal dependencies in sequential network traffic data, enabling accurate classification of benign and malicious activity while maintaining computational efficiency. The proposed model underwent rigorous validation to assess both its detection accuracy and generalizability. This was achieved by utilizing two distinct datasets that encompass realistic network traffic and a wide array of attack scenarios, including Denial of Service (DoS), Probe, User-to-Root (U2R), and Remote-to-Local (R2L) intrusions. The performance of the model is compared with several other recent models. The proposed model achieved high classification results among all the compared models, with an accuracy of 99.94%, precision of 99.98%, recall of 99.93%, and an F1-score of 99.95%. These outstanding results underscore the model’s robust capability to accurately identify and flag malicious activities within complex network environments. The model’s generalization power was similarly affirmed on a second independent dataset. The model maintained strong performance with an accuracy of 99.42%, precision of 99.20%, recall of 99.69%, and an F1-score of 99.45%. The successful demonstration of both high detection accuracy and strong generalization capability highlights the practical utility and inherent reliability of our proposed model for real-world threat detection.