ADAPTIVE INTRUSION DETECTION SYSTEMS USING MACHINE LEARNING IN CLOUD ENVIRONMENTS

Intrusion detection systems are used to detect attacks in a network. Machine learning (ML) approaches have been widely used to build such Intrusion Detection Systems (IDSs) because they are more accurate when built from a very large and representative dataset. In recent times, one of the benchmark datasets that are used to build ML-based Intrusion Detection models is CICIDS2017 dataset. The dataset is contained in eight groups and was collected from the Canadian Institute on Cyber Security dataset repository. The dataset is available in both PCAP and netflow formats. This study used the netflow records in the CIDIDS2017 dataset as they are found to contain newer attacks,very large and are found useful for traffic analysis. Exploratory Data Analysis (EDA) techniques were used to reveal various characteristics of the dataset. The general objective is to provide more insights on the nature, structure and issues with the dataset so as to identify the best ways for using it to achieve improved ML-based IDS models. Furthermore, some of the open problems that can arise from the use of the dataset in any machine learning-based Intrusion Detection systems are highlighted and possible solutions are briefly discussed. The EDA techniques used revealed important relationships among input variables and the target class. The study concluded that the EDA can better influence the decision of future IDS researches that use the dataset. Thus, improved machine learning-based intrusion detection systems can be built from the dataset once it is well understood and pre-processed.

Investigating the use of moving target defense (MTD) mechanisms in IoT networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite the computational deficiencies many IoT ecosystems typically have. The AI community has extensively studied adversarial threats and attacks on machine learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. Another concept that has gained significant attention in the networking community is Game Theory. Protecting any given network is almost a never-ending battle between the attacker and defender, and hence a natural game of competitors can be modelled based on one’s parametric specifications to gain more insight into how attackers might interact with one’s system. The goal of this thesis is to propose a comprehensive, experimentally verifiable game-theoretic model of MTD in IoT networks to secure the IDS against adversarial attacks. Once a game with state transitions based on given actions can be modelled, reinforcement learning is used to develop policies based on various episodes (rounds) of the game, ultimately optimizing network decisions to minimize successful attacks on machine learning-based IDS. The state-of-the-art ToN-IoT dataset was investigated for MTD feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS was compared to a conventional IDS by analyzing the accuracy curve of the MTD-based IDS and the conventional IDS for varying attacker success rates and resource demands. Our approach has proven effective in securing the IDS against adversarial learning.

Adversarial machine learning is a recent area of study that explores both adversarial attack strategy and detection systems of adversarial attacks, which are inputs specially crafted to outwit the classification of detection systems or disrupt the training process of detection systems. In this research, we performed two adversarial attack scenarios, we used a Generative Adversarial Network (GAN) to generate synthetic intrusion traffic to test the influence of these attacks on the accuracy of machine learning-based Intrusion Detection Systems(IDSs). We conducted two experiments on adversarial attacks including poisoning and evasion attacks on two different types of machine learning models: Decision Tree and Logistic Regression. The performance of implemented adversarial attack scenarios was evaluated using the CICIDS2017 dataset. Also, it was based on a comparison of the accuracy of machine learning-based IDS before and after attacks. The results show that the proposed evasion attacks reduced the testing accuracy of both network intrusion detection systems models (NIDS). That illustrates our evasion attack scenario negatively affected the accuracy of machine learning-based network intrusion detection systems, whereas the decision tree model was more affected than logistic regression. Furthermore, our poisoning attack scenario disrupted the training process of machine learning-based NIDS, whereas the logistic regression model was more affected than the decision tree.

Cybersecurity has become a priority concern of the digital society. Many attacks are becoming more sophisticated, requiring strengthening the strategies of identification, analysis, and management of vulnerability to stop threats. Intrusion Detection/Prevention Systems are first security devices to protect systems. This paper presents a survey of several aspects to consider in machine learning-based intrusion detection systems. This survey presents the Intrusion Detection Systems taxonomy, the types of attacks they face, as well as the organizational infrastructure to respond to security incidents. The survey also describes several investigations to detect intrusions using Machine Learning, describing in detail the databases used. Moreover, the most accepted metrics to measure the performance of algorithms are presented. Finally, the challenges are discussed motivating future research.KeywordsIntrusion detection systemsMachine learningCyber security

Smart grids represent the modernization of electrical grids by integrating advanced communication and information technology. However, their interconnected nature and reliance on digital infrastructure make them vulnerable to cyber-attacks. Enhancing cybersecurity in smart grids is paramount to ensure reliability and safety. This paper explores the use of Machine Learning-Based Intrusion Detection Systems (ML-IDS) as a solution to enhance the cybersecurity of smart grids. It examines the current cybersecurity challenges in smart grids, the fundamentals of intrusion detection systems, the integration of machine learning in IDS, and the effectiveness of ML-IDS in mitigating cyber threats.

This dynamism of cyber threats in Industry4.0 and Industry Internet of Things (IIoT) setting makes any static machine learning-based Intrusion Detection Systems (IDS) ineffective in the face of concept drift. As a solution to it, we introduce HYRIDE-RL, a hybrid adaptive IDS, which incorporates Deep Reinforcement Learning (DRL) with an anomaly detector to perform autonomous real time adaptation. Developed as a Markov Decision Process (MDP), a Deep Q-Network (DQN) adaptively modulates the sensitivity of detection based on network statistics and performance feedback. Some of the innovations are a multi-faceted state representation, replay-buffer reset enabling catastrophic forgetting and guided reward shaping to achieve faster recovery. The experiment involving the CICIDS 2017 dataset proves that the difference is not extremely large, but it does exist and the two classes in question are not very different. Model collapse $\mathbf{9 1 . 2} \boldsymbol{\%}$ to $\mathbf{2 . 5} \boldsymbol{\%}$ accuracy, HYRIDE-RL in practice recovers $88.6 \%$ accuracy of 0.917 AUC, reducing recovery. Time by $53 \%$. These results prove its capability in non-stationary and dynamic IIoT.

Optimized machine learning enabled intrusion detection 2 system for internet of medical things

Internet of Things (IoT) security dataset evolution: Challenges and future directions

The increasing complexity of cyber threats targeting cloud infrastructures demands advanced and adaptive intrusion detection systems (IDS). This study explores the application of deep learning (DL) models—Convolutional Neural Networks (CNN), Long Short-Term Memory networks (LSTM), and a hybrid CNN+BiLSTM architecture—for detecting network intrusions using benchmark datasets CIC-IDS2017 and UNSW-NB15. This study contributes by demonstrating how hybrid CNN+BiLSTM architectures enhance intrusion detection accuracy on benchmark datasets, offering low latency and improved recall for rare attack classes, thereby validating their suitability for real-time cloud security deployment. Results show that hybrid CNN+BiLSTM models outperform standalone CNN and LSTM architectures in detection performance, achieving accuracies up to 97.4% on CIC-IDS2017 and 96.85% on UNSW-NB15, while maintaining acceptable latency for real-time deployment. The hybrid model also demonstrates superior F1-scores for rare attack classes and lower false positive rates. The discussion highlights the importance of dataset quality, feature engineering, and the role of adversarial training and model optimization in enhancing robustness. In conclusion, this work affirms the value of hybrid DL architectures for cloud-based IDS and suggests future directions in federated learning, adaptive retraining, and deployment in edge environments.

This study proposes a lightweight machine learning-based intrusion detection system (IDS) designed for smart grid environments. The framework integrates feature extraction using autoencoders, dataset balancing with SMOTE, and multiple machine learning and deep learning classifiers to detect cyberattacks efficiently. Experimental results on the UNSW-NB15 dataset demonstrate high detection accuracy and short training time, highlighting the suitability of lightweight IDS models for deployment at resource-constrained edge access points in smart grids.

Intrusion detection systems are mainly prevalent proclivity within our culture today. Interference exposure systems function as countermeasures to identify web-based protection threats. This is a computer or software program that monitors unauthorized network activity and sends alerts to administrators. Intrusion detection systems scan for known threat signatures and anomalies in normal behaviour. This article also analyzed different types of infringement finding systems and modus operandi, focusing on support-vector-machines; Machine-learning; fuzzy-logic; and supervised-learning. For the KDD dataset, we compared different strategies based on their accuracy. Authors pointed out that using support vector machine and machine learning together improves accuracy.

Cyber security is a big issue in current society since exploiting computer network vulnerabilities has become simple thanks to technological advances and human talents.Currently, several types of assaults are occurring, such as DOS attacks, probing, R2U, R2L viruses, port scanning, buffer overflow, CGI attacks, and floods, among others. A strong foundation is required to build a system for detecting and preventing these threats. The majority of the most recent ways for implementing IDS for computer security are covered in this article. Intrusion Detection Systems are the best answer for cyber-attacks. In a continuously changing environment, machine learning-based intrusion detection systems exhibit excellent accuracy. This study provide a broad overview of machine-learning algorithms, focusing on how they may be used for sophisticated data processing and automation in cybersecurity, with a particular focus on their ability to extract useful insights from cyber data. In addition to, this study investigates a variety of practical applications wherein information knowledge, mechanization, and decision-making might be used to provide proactive, next-generation cyber security. Our paper concludes by emphasizing the potential of computer vision in security in the future and pointing the way toward further research. Ultimately, this study intends to focus on how the status of learning algorithms and related approaches might inform future advancements in the field of cybersecurity.

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The evolution from conventional network frameworks to Software-Defined Networks (SDNs) marks a pivotal shift in network management. SDNs offer a unique architecture where a centralized controller orchestrates network traffic, separating the control plane from the data plane. This architecture not only brings enhanced flexibility, agility, and scalability to network operations but also introduces specific security challenges, primarily due to the centralization of control, which can be a potential Single Point of Failures (SPOFs). Addressing these security concerns, this paper introduces an innovative machine learning-based Intrusion Detection System (IDS) tailored for SDNs, by proposing a three-stage CatBoost Classifier (3CC). This classifier is specifically designed for efficient and effective intrusion and vulnerability detection within SDN environments. The multistage aspect of the classifier allows for refined and detailed analysis, catering to a diverse array of attack vectors. Another key feature of our approach is the utilization of real-world data from SDN environments, which ensures that our model is tested and validated under realistic and current conditions. Furthermore, the integration of GPU acceleration significantly enhances the training speed of our model, a critical factor given the voluminous nature of network data. The proposed model, 3CC, demonstrates remarkable performance in our evaluations, achieving an accuracy of 99.8966%. This high level of precision in detecting and identifying various network intrusions and vulnerabilities underlines the efficacy of our approach. Our paper contributes significantly to the field of SDN security, offering a sophisticated, multistage classification solution that leverages the latest in machine learning techniques and real-world applicability.