An energy-efficient privacy-preserving framework for intrusion detection in the internet of vehicles

Wireless Sensor Networks (WSNs) are increasingly vulnerable to sophisticated cyber threats, necessitating advanced intrusion detection systems (IDS) that balance high accuracy with interpretability. This paper presents a Knowledge-Improved Hybrid Deep Neural Network-Kolmogorov Arnold Network (DNN-KAN) Framework for intrusion detection in WSNs, integrating data-driven learning with domain-specific knowledge to enhance detection performance. The proposed framework preprocesses and merges multiple datasets (WSN, NSL-KDD, and CICIDS2017), extracts features using Principal Component Analysis (PCA), and constructs a knowledge graph to embed expert-defined rules via Graph Convolutional Networks (GCNs). The hybrid architecture employs a DNN for hierarchical feature extraction and replaces the fully connected layer with a KAN layer, leveraging the Kolmogorov-Arnold Theorem to decompose complex relationships into interpretable univariate functions. Evaluated on key metrics, the model achieves 99.87% accuracy, 99.85% precision, and a 0.9985 ROC-AUC score, significantly outperforming traditional DNNs, standalone KANs, and state-of-the-art models like CNN-LSTM and Transformer-based IDS. By incorporating domain knowledge into the loss function, the framework reduces false positives and improves generalization, even with limited training data. This work demonstrates that combining knowledge-driven constraints with hybrid neural architectures can yield highly accurate, interpretable, and robust intrusion detection for WSN security.

Cyber-physical systems have recently emerged in several practical engineering applications where security and privacy are of paramount importance. This motivated the paper and a recent surge of interest in development of innovative and novel anomaly and intrusion detection technologies. This paper proposes a novel distributed blind intrusion detection framework by modeling sensor measurements as the target graph-signal and utilizing the statistical properties of the graph-signal for intrusion detection. To fully take into account the underlying network structure, the graph similarity matrix is constructed using both the data measured by the sensors and sensors' proximity resulting in a data-adaptive and structure-aware monitoring solution. In the proposed supervised detection framework, the magnitude of the captured data is modeled by Gaussian Markov random field and the corresponding precision matrix is estimated by learning a graph Laplacian matrix from sensor measurements adaptively. The proposed intrusion detection methodology is designed based on a modified Bayesian likelihood ratio test and the closed-form expressions are derived for the test statistic. Finally, temporal analysis of the network behavior is established by computing the Bhattacharyya distance between the measurement distributions at the consecutive time instants. Experiments are conducted to evaluate the performance of the proposed method and to compare it with that of the state-of-the-art methods. The results show that the proposed intrusion detection framework provides a detection performance superior to those provided by the other existing schemes.

This study explores the development of robust Intrusion Detection Systems (IDS) to enhance cybersecurity in Wireless Sensor Networks (WSNs) within the evolving Internet of Things (IoT) ecosystem. It leverages a publicly available dataset derived from UNSW-NB15, retrieved from a GitHub repository, capturing diverse network traffic attributes (dttl, swin, dwin, tcprtt, synack, ackdat), protocol-specific indicators (proto tcp, proto udp), and service-specific attributes (service dns). These features enable precise analysis of TCP/IP headers and traffic patterns, supporting multi-class classification into four categories: Analysis, Denial of Service (DoS), Exploits, and Normal. Advanced machine learning algorithms, including Random Forest, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN), were applied with systematic preprocessing (including KNN-based imputation, normalization, and one-hot encoding), feature selection using Random Forest importance, and 5-fold cross-validation. The best performance was achieved by Random Forest (accuracy, precision, recall, and F1-score of 99.9877%), followed by KNN (99.9754%) and SVM (99.9630%). The study demonstrates that combining well-structured models with relevant protocol-level features and robust evaluation strategies can significantly enhance intrusion detection capabilities in IoT-based environments. It reinforces the value of using modern public datasets and interpretable algorithms for building scalable and reliable IDS solutions.

In this paper we introduce the framework of a novel Service-oriented and User-centric Intrusion Detection System (SUIDS). It is proposed to protect ubiquitous computing environments like a smart home/office. Existing Intrusion Detection Systems (IDSs) fail to cope with such a highly heterogeneous and flexible environment due to their homogeneous system design and ineffective auditing mechanisms. Featuring a novel auditing mechanism and system architecture, SUIDS can effectively detect malicious activities of inside users. Specifically, the paper shows how network nodes are classified in order to accommodate different types of detection modules; how service specific knowledge and user profiles are used to audit users' activities and protect various networked appliances against intrusions; and how a user-centric approach is used to compose a dynamic 'defense wall' or 'quarantine' against malicious users. As a result, intrusion detection in our SUIDS is more reliable and resource-effective, with a lightweight, adaptive and heterogeneous system design. Keywords-intrusion detection; service-oriented; ubiquitous

In-vehicle buses and the Controller Area Network (CAN) in particular have been shown to be vulnerable to adversarial actions. We embed adversary models and intrusion detection systems (IDS) inside a CANoe based application. Based on real-world CAN traces collected from several vehicles we build attack traces that are subject to intrusion detection algorithms. We also take benefit from existing machine-learning support in MATLAB that is ported via C++ code in CANoe in order to integrate intrusion detection functionality. A unified framework for attacks and intrusion detection has the benefit of providing a testbed for various intrusion detection algorithms. CANoe integration makes the use of these functionalities ready for realistic testing as CANoe is an industry-standard tool in the automotive domain.

To address the challenges of traffic diversity and data imbalance in network intrusion detection, we propose GraphACGAN, a novel detection framework that integrates auxiliary classifier generative adversarial networks (ACGANs) with graph neural networks (GNNs). In this architecture, the GNN is embedded in the ACGAN discriminator to exploit the latent graph structures inherent to network traffic, thereby improving the model's capacity to distinguish between benign and malicious behaviors. Simultaneously, the ACGAN generator was leveraged to synthesize minority‐class attack traffic, effectively mitigating class imbalances and enhancing generalization. Comprehensive experiments conducted on three benchmark datasets, namely, NF‐BoT‐IoT‐v2, NF‐ToN‐IoT‐v2, and NF‐UNSW‐NB15‐v2, demonstrate that GraphACGAN consistently outperforms all baselines, including E‐GraphSAGE, GCN, ACGAN, LSTM, and KNN in terms of accuracy, precision, recall, and F 1 ‐score. An evaluation of resource‐limited computing platforms further demonstrates GraphACGAN's inference efficiency for real‐world deployment.

Current intrusion detection models based on machine learning require reliable datasets, but the public dataset updates are typically delayed after new attacks, which slows down the model's update speed. Also, to train the existing model, the data needs to be shared; hence, it lacks data integrity. To address this issue, this project implements a never-ending learning (NEL) framework for intrusion detection that utilizes multi-task and transfer learning to continuously acquire knowledge from private datasets, regardless of sharing them publicly. The NEL framework also integrates serendipitous learning, which updates the model by identifying and classifying new attack categories from the suspected traffic of attacked devices. The project also enhances various continuous learning training methods with federated learning to safeguard user privacy, ensuring that user data is not transmitted directly.

The inherent complexity and heterogeneity of the Internet of Things (IoT) ecosystem present significant challenges for developing effective intrusion detection systems. While graph deep-learning-based methods have shown promise in cybersecurity applications, existing approaches primarily construct graphs based on physical network connections, which may not effectively capture node representations. This paper proposes a Top-K Similarity Graph Framework (TKSGF) for IoT network intrusion detection. Instead of relying on physical links, the TKSGF constructs graphs based on Top-K attribute similarity, ensuring a more meaningful representation of node relationships. We employ GraphSAGE as the Graph Neural Network (GNN) model to effectively capture node representations while maintaining scalability. Furthermore, we conducted extensive experiments to analyze the impact of graph directionality (directed vs. undirected), different K values, and various GNN architectures and configurations on detection performance. Evaluations on binary and multi-class classification tasks using the NF-ToN IoT and NF-BoT IoT datasets from the Machine-Learning-Based Network Intrusion Detection System (NIDS) benchmark demonstrated that our proposed framework consistently outperformed traditional machine learning methods and existing graph-based approaches, achieving superior classification accuracy and robustness.

With the development of 5G technology, internet traffic has surged dramatically, presenting severe challenges to cybersecurity. Considering that network traffic exhibits temporal correlation, it can be used as a basis for identifying network attacks. In this paper, a joint framework of network traffic interpolation and intrusion detection is proposed. First, by leveraging historical network traffic, traffic characteristics can be obtained, allowing for preemptive prevention of network attacks. To obtain network features at equal time intervals, the Lagrange interpolation method is introduced. Second, a deep learning algorithm combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) Networks is proposed to extract spatiotemporal features from network traffic, distinguishing between normal and abnormal network activities. Experimental results based on real network traffic dataset show that the intrusion detection accuracy using CNN and LSTM can reach above 90%, which shows that the proposal can achieve reliable intrusion detection to defend against cyber attacks.

The accelerated development of cloud computing has brought complex cybersecurity challenges, and these needs demand intelligent, scalable, and dynamic intrusion detection solutions. This study represents a powerful architecture of cloud-native intrusion detection, which uses the deep learning architecture of a cybersecurity use in the AWS background. The proposed system integrates the present deep learning systems, such as CNN and DNN to identify and classify malicious activities on a real-time basis. The training and evaluation of the base model is trained and tested on the CSE-CICiders2018 dataset that was developed in the AWS environment. The architecture applies AWS-native (SageMaker) to develop host model deployment, Lambda to provide automatic service (threat response) and Security Hub to administer centralized alert management. Normalization of the data using the StandardScaler method and division of the data into 80-20 train-validation data also helped in enhancing the integrity of the data and the model accuracy. The experiment results confirm that the CNN-based model worked better with the accuracy of 99.10, in contrast to random forest and SVM, that are the classic classifiers. The system will be connected to AWS Simple Notification Service (SNS) in order to receive immediate threat alert to enable quick reaction to an incident. Overall, this framework provides a robust, adaptable, and automated security framework that is capable of ensuring a high degree of precision and dependability in dynamic cloud settings, which is a next-generation model of cloud-based intrusion detection.

As modern attack methods become more concealed and complex, obtaining many labeled samples in big data streams is difficult. Active learning has long been used to achieve better intrusion detection performance by using only a small number of training samples. Intrusion behaviors can be described by provenance graphs that record the dependency relationships between intrusion processes and the infected files. It is a challenge to develop active learning strategies that consider defining and selecting the most valuable provenance and ensure that the strategy for querying provenance is efficient. We present Angus, an active learning framework for provenance-based intrusion detection. We propose two novel active learning strategies: the most similar graph query strategy and the maximum difference query strategy. They either select samples to update the training set according to similarities of provenance graphs or preferentially select samples with low redundancy and large differences from the current training set. Besides, we also improve the above query strategies by using the parallel query to reduce detection time overheads. The experiments on various real-world applications demonstrate their performance and efficiency.

The Industrial Internet of Things (IIoT) offers the manufacturing sector opportunities for transformation and upgrade but also carries significant security risks. Traditional federated learning (FL) as a potential security solution is challenging in complicated application environments with heterogeneous data, imbalanced data, and poisoning attacks. To address these challenges, we construct a clustered FL Framework for IIoT intrusion detection (CFL-IDS) based on local models’ evaluation metrics (EMs). First, we designed an intrusion detection model with a dynamic focal loss (DFL) for all edge nodes (ENs). This model’s performance is enhanced under various imbalanced data partitions by dynamically altering the focus on samples during the loss minimization training process. Second, the time series of EMs of local models to reflect the data distribution of ENs implicitly, and use clustering algorithms to facilitate knowledge sharing among those ENs with similar data distribution to co-optimize a common model for them. Finally, an intelligent cooperative model aggregation mechanism (ICMAM) adaptively adjusts each local model’s weight distribution, which substantially improves the benefits of FL and alleviates subpar models’ alleviates interference from subpar models to FL. Experiments demonstrate that CFL-IDS has stronger robustness and displays superior performance under data imbalance and non-independent and identically distributed (non-IID) situations while being effective against poisoning attacks.

Intrusion detection has been of prime concern in the Internet of Things (IoT) environment due to the rapid increase in cyber threats. Majority of traditional intrusion detection systems (IDSs) rely on centralized models, raising significant privacy concerns. Federated learning (FL) offers a decentralized alternative; however, many existing FL-based IDS frameworks suffer from poor performance due to suboptimal model architectures and ineffective hyperparameter selection. To address these challenges, this paper introduces a novel trust-centric FL framework based on the tab transformer (TTF) model for IDS. We enhance the Tab model through an optimization process, utilizing a hyperparameter tuning algorithm inspired by the nature-based electric eel foraging optimization (EEFO) algorithm. The goal of the developed framework is to improve the detection of IDS without using centralized data to preserve privacy. Whereas it enhances the processing and detection capability of huge amounts of data generated from IoT devices. Our framework is tested on three IoT datasets: N-BaIoT, UNSW-NB15, and CICIoT2023 to ensure the model's performance. Experimental results show that the proposed framework significantly exceeds traditional methods in terms of accuracy, precision, and recall. The results presented in this study confirm the effectiveness and superior performance of the proposed FL-based IDS framework.

Advances in wireless communications and microelectronics have spearheaded the development of unmanned aerial vehicles (UAVs), which can be used to augment a ground network composed of sensors and/or vehicles in order to increase coverage, enhance the end-to-end delay, and improve data processing. While UAV-aided networks can potentially find applications in many areas, a number of issues, particularly security, have not been readily addressed. The intrusion detection system is the most commonly used technique to detect attackers. In this paper, we focus on addressing two main issues within the context of intrusion detection and attacker ejection in UAV-aided networks, namely, activation of the intrusion monitoring process and attacker ejection. In fact, when a large number of nodes activate their monitoring processes, the incurred overhead can be substantial and, as a consequence, degrades the network performance. Therefore, a tradeoff between the intrusion detection rate and overhead is considered in this work. It is not always the best strategy to eject a node immediately when it exhibits a bad sign of malicious activities since this sign could be provisional (the node may switch to a normal behavior in the future) or be simply due to noise or unreliable communications. Thus, a dilemma between detection and false positive rates is taken into account in this paper. We propose to address these two security issues by a Bayesian game model in order to accurately detect attacks (i.e., high detection and low false positive rates) with a low overhead. Simulation results have demonstrated that our proposed security game framework does achieve reliable detection.

Cyberthreats and hazardous application usage have increased due to growing use of internet services and apps over computer networks, endangering customer privacy and service availability. To address this, a hybrid optimized attention residual net security framework for network Intrusion Detection System (IDS) is employed in digital infrastructure to identify abnormal traffic behaviors that conventional firewalls are unable to detect. In IDS, the input data is preprocessed to eliminate noisy and irrelevant data. The raw data is preprocessed by comprising encoding and normalization techniques. It ensures resolution and makes it suitable for the DL model. A novel framework is an attention residual net that focuses on prominent features in the input data and eliminates vanishing gradient issues. The performance of the attention residual net is further enhanced by utilizing the Dragon Fly Optimization (DFO) algorithm that finely tunes its hyperparameters. The hybrid approach is implemented in Python and combines the efficiency of DL-based hybrid Attention ResNet and DFO algorithms to attain a robust and secure IDS, thus making it feasible for safeguarding digital infrastructure.