A novel intrusion detection system based on an optimal hybrid kernel extreme learning machine

Kernel principal component analysis (KPCA) has been effectively applied as an unsupervised non-linear feature extractor in many machine learning applications and suggested for various data stream classification tasks requiring a nonlinear transformation scheme to reduce dimensions. However, the dimensionality reduction ability is restricted because of KPCA’s high time complexity. So the practicality of KPCA on large datasets is rare. Therefore in this paper, we proposes a novel kind of incremental kernel principal component analysis algorithm: Data characteristic extraction based on IPCA algorithm –DCEIPCA, which allows efficient processing of large datasets and overcome the insufficient of KPCA. On the basis of DCEIPCA, we propose Classification expert system (CES) for intrusion detection system. Extensive experiments on KDDcup99 datasets confirm the superiority of Intrusion detection system based on CES(IDSCES) over other recent Intrusion detection system[4-11].

This paper presents a novel algorithm - robust kernel principal component analysis (robust KPCA), on the basis of the research of kernel principal component analysis (KPCA) and robust principal component analysis (RPCA). First, this algorithm sets the radius of the images of the training samples in the feature space using kernel tricks, then determines whether the samples are outliers or not, and finally analyzes the training samples which have eliminated the outliers using KPCA algorithm. The improved KPCA algorithm not only retains the non-linearity property of KPCA algorithm but also gets better robustness. Because the effects of outliers are eliminated, robust KPCA algorithm gets higher accuracy than KPCA algorithm for data analysis. The simulation experiments show that the robust KPCA algorithm developed is better than the KPCA algorithm.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

In the context of a computer system, computer security is the prevention of an illicit action against the system. For this purpose, computer security must determine the difference between normal and harmful activities. These activities can come from outside or from inside the system to be protected. In a similar manner, the role of the Human Immune System (HIS) is to detect and defend against harm. This similarity has inspired approaches in the area of computer security, including the use of immune-based approaches to build Intrusion Detection and Response Systems (IDRSs). As a concrete example, this chapter introduces a new approach for Intrusion Detection (ID) and Intrusion Response (IR) to build a completely distributed and decentralised IDRS for use in computer networks. This approach is called Intrusion Detection and Response extended with Agent Mobility, or IDReAM for short. IDReAM combines Mobile Agents (MAs) with two self-organising paradigms inspired by natural life systems. The Intrusion Detection System (IDS) is inspired by the metaphor of the immune system that protects the human body from external threats. Specialised cells of the immune system, called the T cells, travel around the body to detect possible threats by eliminating the proteins that they do not recognise as safe proteins—referred to as non-self proteins. Intrusion Detection Agents (IDAs) roam the network to detect suspicious behaviours in a manner that mimics the behaviour of T cells. The Intrusion Response System (IRS) also borrows mechanisms from the stigmergic paradigm of a colony of ants. At the time of foraging, the ants use the environment to diffuse a chemical substance called the pheromone which traces the route for the other ants from the nest to the source of food. Intrusion Response Agents (IRAs) roam the network to respond to the IDAs’ alerts, mimicking the behaviour of the ants to trace the route to the alert and give the response. The two natural systems exhibit a social behaviour by the organisation of their entities, T cells and ants, which is not possible without the functionality of mobility.KeywordsIntrusion DetectionAgent MobilityIntrusion Detection SystemComputer SecurityHuman Immune SystemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Intrusion Detection Systems (IDS) have become an important building block of any sound defense network infrastructure. Malicious attacks have brought more adverse impacts on the networks than before, increasing the need for an effective approach to detect and identify such attacks more effectively. In this study two learning approaches, K-Means Clustering and Naive Bayes classifier (KMNB) are used to perform intrusion detection. K-Means is used to identify groups of samples that behave similarly and dissimilarly such as malicious and non-malicious activity in the first stage while Naive Bayes is used in the second stage to classify all data into correct class category. Experiments were performed with KDD Cup '99 data sets. The experimental results show that KMNB significantly improved and increased the accuracy, detection rate and false alarm of single Naive Bayes classifier up to 99.6, 99.8 and 0.5%.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

An IKPCA-ELM-based intrusion detection method is developed to address the problem of the low accuracy and slow speed of intrusion detection caused by redundancies and high dimensions of data in the network. First, in order to reduce the effects of uneven sample distribution and sample attribute differences on the extraction of KPCA features, the sample attribute mean and mean square error are introduced into the Gaussian radial basis function and polynomial kernel function respectively, and the two improved kernel functions are combined to construct a hybrid kernel function. Second, an improved particle swarm optimization (IPSO) algorithm is proposed to determine the optimal hybrid kernel function for improved kernel principal component analysis (IKPCA). Finally, IKPCA is conducted to complete feature extraction, and an extreme learning machine (ELM) is applied to classify common attack type detection. The experimental results demonstrate the effectiveness of the constructed hybrid kernel function. Compared with other intrusion detection methods, IKPCA-ELM not only ensures high accuracy rates, but also reduces the detection time and false alarm rate, especially reducing the false alarm rate of small sample attacks.

Chapter 5 - Intrusion Prevention and Detection Systems

Computational complexity and sample selection are two main factors that limited the performance of online sequential extreme learning machines (OS-ELMs). This paper proposes a new model that introduces the concept of hybrid kernel and sample selection method based on an online learning model using a membership function. In other words, an online sequential extreme learning machine based on a hybrid kernel function (HKOS-ELM) is presented. The algorithm only calculates the kernel function to determine the final output function, mostly solving the computational complexity of the algorithm. The hybrid kernel function proposed in this paper has the advantages of strong learning ability and good generalization performance of single kernel function. Based on the classification essence of the OS-ELM classification, the membership function is introduced into the sample selection to remove the noise point and the outlier point. The experimental results showed that the HKOS-ELM algorithm adding the membership degree with mixed kernel functions preserves the advantages of kernel functions and online learning and improves the classification performance of the system.

As the network spreads to each corner of the world, computers are exposed to miscellaneous intrusion from the World Wide Web. We need effective intrusion detection system to protect our computers from these unauthorized or malicious actions. As pattern recognition method used in intrusion detection system, the limitation in traditional detection methods is cancelled. In this paper a new intrusion detection approach using multiclassifier combination based on protocol analysis is proposed. Experiment has been done on dataset in KDD-99 and the result shows that it is an effective method.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Kernel principal component analysis (KPCA) as a powerful nonlinear feature extraction method has proven as a preprocessing step for classification algorithm. A face recognition approach based on KPCA and genetic algorithms (GAs) is proposed. By the use of the polynomial functions as a kernel function in KPCA, the high order relationships can be utilized and the nonlinear principal components can be obtained. After we obtain the nonlinear principal components, we use GAs to select the optimal feature set for classification. At the recognition stage, we employed linear support vector machines (SVM) as classifier for the recognition tasks. Two face databases were used to test our algorithm and higher recognition rates were obtained which show that our algorithm is effective.

Given the exponential growth of Internet and increased availability of bandwidth, Intrusion Detection has become the critical component of Information Security and the importance of secure networks has tremendously increased. Though the concept of Intrusion Detection was introduced by James Anderson J. P. in the year 1980, it has gained lots of importance in the recent years because of the recent attacks on the IT infrastructure. The main objective of this study is to examine the existing literature on various approaches for Intrusion Detection in particular Anomaly Detection, to examine their conceptual foundations, to taxonomize the Intrusion Detection System (IDS) and to develop a morphological framework for IDS for easy understanding. In this study a detailed survey of IDS from the initial days, the development of IDS, architectures, components are presented.

Intrusion detection has become a critical component of network administration due to the vast number of attacks persistently threaten our computers. Traditional intrusion detection systems are limited and do not provide a complete solution for the problem. They search for potential malicious activities on network traffics; they sometimes succeed to find true security attacks and anomalies. However, in many cases, they fail to detect malicious behaviours (false negative) or they fire alarms when nothing wrong in the network (false positive). In addition, they require exhaustive manual processing and human expert interference. Applying Data Mining (DM) techniques on network traffic data is a promising solution that helps develop better intrusion detection systems. Moreover, Network Behaviour Analysis (NBA) is also an effective approach for intrusion detection. In this paper, we discuss DM and NBA approaches for network intrusion detection and suggest that a combination of both approaches has the potential to detect intrusions in networks more effectively.

Internet of things intrusion detection model and algorithm based on cloud computing and multi-feature extraction extreme learning machine