An innovative network intrusion detection system (NIDS): Hierarchical deep learning model based on Unsw-Nb15 dataset

The subject matter of this article is a HybridAttention mechanism integrated into a deep neural architecture for Network Intrusion Detection Systems (NIDS). This study aims to develop and study a HybridAttention mechanism based on a combination of global (self-attention) and local (dynamic local attention) models to improve the quality of traffic classification in real-time NIDS. The tasks to be solved are as follows: analyzing the applicability of existing attention mechanisms in network intrusion detection; integrating various attention types into a CNN-BiGRU architecture; developing a HybridAttention mechanism based on dynamic window alignment; optimizing the model using Optuna; and experimentally evaluating its performance on benchmark datasets using standard classification metrics. The methods used are: deep learning modeling with CNN-BiGRU architecture, integration of various attention mechanisms, including a novel HybridAttention, hyperparameter optimization using Optuna, and performance evaluation based on standard classification metrics. The results of this study show that the proposed HybridAttention mechanism demonstrates superiority over individual types of attention in all key metrics. The model achieved up to 99.85% accuracy on the NSL-KDD dataset training data and demonstrated strong generalization on the UNSW-NB15 dataset, achieving up to 98.06% accuracy in multi-class classification and up to 99.20% in binary classification. The proposed model also outperformed state-of-the-art approaches for processing unbalanced data and detecting various types of attacks. Conclusions. The scientific novelty of the results obtained is as follows: a HybridAttention mechanism combining self-attention and dynamic local attention was developed to enhance sequential pattern recognition in network traffic; the CNN-BiGRU architecture was improved by integrating multiple attention modules; systematic hyperparameter optimization using Optuna improved generalization on imbalanced data; and the proposed model outperformed existing approaches on benchmark datasets in detecting both known and novel cyberattacks.

Network intrusion attacks are a known threat. To detect such attacks, network intrusion detection systems (NIDSs) have been developed and deployed. These systems apply machine learning models to high-dimensional vectors of features extracted from network traffic to detect intrusions. Advances in NIDSs have made it challenging for attackers, who must execute attacks without being detected by these systems. Prior research on bypassing NIDSs has mainly focused on perturbing the features extracted from the attack traffic to fool the detection system, however, this may jeopardize the attack’s functionality. In this work, we present TANTRA, a novel end-to-end Timing-based Adversarial Network Traffic Reshaping Attack that can bypass a variety of NIDSs. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between the target network’s benign packets. The trained LSTM is used to set the time differences between the malicious traffic packets (attack), without changing their content, such that they will “behave” like benign network traffic and will not be detected as an intrusion. We evaluate TANTRA on eight common intrusion attacks and three state-of-the-art NIDS systems, achieving an average success rate of 99.99% in network intrusion detection system evasion. We also propose a novel mitigation technique to address this new evasion attack.

Network intrusion detection systems (NIDS) are essential for protecting computer networks against cyberattacks. The selection of a nominal set of essential features that may adequately discriminate malicious traffic from normal traffic is indispensable while developing a NIDS. As such, a more reliable and accurate detection result may be realized when intrusion detection is carried out on a dataset based on an inclusive feature representation. This work presents the pre-processing and feature selection workflow as well as its results in the case of the CIC-IDS-2017 dataset, with a focus on two cyber-attacks, namely Denial-of-Service (DoS) and PortScan. The study applied an ensemble feature selection method based on information gain and Random Forest to filter out important features. Recursive Feature Elimination method was then applied to the reduced features to optimize the selected feature subset. The selected feature subset was experimented with using two classification algorithms, namely support vector machine and multi-layer perceptron. In the evaluation process, four widely used performance metrics were considered. The study results demonstrated the efficacy of the proposed ensemble approach to optimize the selected feature subset for detecting PortScan and DoS attacks in network traffic. Experimental results revealed that the support vector machine had a slight advantage in accuracy and could train more quickly. According to the study's evaluation, the NIDS may be able to shorten processing times without sacrificing the ability to detect PortScan and DoS attacks accurately by choosing a narrow subset of informative features. This suggests the approach might be applicable to real-world NIDS scenarios involving these attacks. The study also provides encouraging perspectives on how ensemble feature selection utilizing MLP and SVM can enhance the effectiveness of NIDS. Building on these findings, more research can create NIDS solutions that are even more reliable and efficient for the dynamic field of cybersecurity.

Maintaining system integrity and protecting sensitive data is critical in today's digital age, underlining the need for strong network intrusion detection in cybersecurity. This paper offers a sophisticated Network Intrusion Detection System (NIDS) built with the NSL-KDD dataset. We developed and analyzed various machine learning models, including Support Vector Machine (SVM), XGBoost, K-Nearest Neighbors (KNN), Decision Tree Classifier (DTC), and Random Forest Classifier (RFC), to evaluate their accuracy, precision, and recall. Our study revealed significant variations in model efficacy following rigorous data pretreatment and hyperparameter tuning, emphasizing the necessity for tailored approaches to detecting intrusions. The findings provide useful insights for future research, which will aid in the creation of more resilient cybersecurity measures to meet growing threats.

In today’s digitally driven world, network security has become a top accountability as cyberattacks become more sophisticated, especially within emerging NextG network infrastructures. Advanced threats, including as zero-day exploits, polymorphic malware, and large-scale distributed denial-of-service (DDoS) attacks, have surpassed traditional Network Intrusion Detection Systems (NIDS), which frequently use out-of-date signature-based methodologies. These conventional methods not only struggle to detect unknown attack patterns but are also hindered by the issue of imbalanced datasets, where minority attack classes are underrepresented and frequently overlooked. To address these challenges, we proposes an innovative NIDS framework tailored for NextG networks that combines Generative Adversarial Networks (GANs) with Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) models. The framework utilizes GANs to generate synthetic samples for minority classes, ensuring a balanced dataset and enhancing the detection of underrepresented attack types. The CNN and LSTM models, applied independently, leverage their respective strengths to extract spatial and temporal features from network traffic, achieving robust classification accuracy. Furthermore, we integrate Local Interpretable Model-Agnostic Explanations (LIME) to make model predictions transparent, increasing trust and usability for practical deployment. Our framework is evaluated on the NF-CSE-CIC-IDS2018 dataset and achieves outstanding results. The LSTM model attains a detection accuracy of 99.67%, while CNN achieves 97.45%. On this GitHub Repository, the entire data analysis and prediction method is available for use by anyone. Here, both models perform exceptionally well in detecting minority attack classes, with the LSTM showing superior consistency across all metrics. This framework’s high accuracy, explainability, and adaptability make it a critical tool for securing dynamic and high-speed NextG networks against evolving cyber threats.

In the process of air combat intention identification, expert experience and traditional algorithm are relied on to analyze enemy aircraft combat intention in a single moment, but the identification time and accuracy are not excellent. In this paper, from the dynamic attributes of an airspace fighter air combat target and the dynamic and time series changing characteristics of the battlefield environment, we introduce the bidirectional long short-term memory neural network (BiLSTM + Attention) intention identification method based on the attention mechanism for air combat intention identification. In this method, five kinds of state parameters, including target maneuver type, distance, flight velocity, altitude and heading angle, were taken as datasets. The BiLSTM + Attention was used to extract enemy aircraft intention features. By introducing attention mechanism, the weight coefficients of characteristic states corresponding to air combat victories were corrected. Finally, it was input into the SoftMax function to obtain the category of the enemy’s intention. Experimental results showed that the proposed method can effectively identify enemy aircraft in the case of high complexity, multidimensional and large amount of data. Compared with bidirectional long short-term memory (BiLSTM), long short-term memory (LSTM), long short-term memory based on attention mechanisms (LSTM + Attention) and support vector machine (SVM) classification, the proposed method had higher accuracy and lower loss value.

System administrators use a network intrusion detection system (NIDS) to identify network security breaches inside their own firm. Building a clever and robust NIDS for irregular and capricious attacks, however, raises various challenges. One of the key subjects in NIDS research in recent years has been the application of machine learning understanding of strategies. This approach provides a network intrusion detection tool that effectively identifies several kinds of network intrusions, including Dos, U2R, R2L, Probe, and Normal.It employs twin support vector machines and decision trees. The trees serve to construct the decision tree for network traffic data. Then, to maximize the separation of the top nodes of the decision tree, the bottom-up merging approach is applied, hence minimizing error buildup during generation. Embedding twin support vector machines inside the decision tree allows one to subsequently use the network intrusion detection model. This performance assessment is based on network intrusion detection analysis datasets—namely KDD-CUP99 and NSLKDD.

Network intrusion detection systems (NIDS) are essential security building-blocks for today's organizations to ensure safe and trusted communication of information. In this paper, we study the feasibility of off-line deep learning based NIDSes by constructing the detection engine with multiple advanced deep learning models and conducting a quantitative and comparative evaluation of those models. We first introduce the general deep learning methodology and its potential implication on the network intrusion detection problem. We then review multiple machine learning solutions to two network intrusion detection tasks (NSL-KDD and UNSW-NB15 datasets). We develop a TensorFlow-based deep learning library, called NetLearner, and implement a handful of cutting-edge deep learning models for NIDS. Finally, we conduct a quantitative and comparative performance evaluation of those models using NetLearner.

Network intrusion detection system (NIDS) is a tool that can detect various network attacks by analyzing network traffic. In recent years, traditional machine learning and deep learning methods have been widely used in NIDS. And these works achieved high detection rate and low false positive rate when identifying common attacks (such as DoS). However, the existing models performed poor in detecting rare or unseen network attacks. In this paper, we design a novel network intrusion detection model based on two-phase detection and manually labeling. This two-phase detection model (TPDM) is a multi-classification system, and it can classify network traffic into benign or specific attack type. TPDM gains the overall accuracy 98.35%, and average F1-score 99.23% on UNSW-NB15 dataset. The experiment shows that TPDM performs better than state of the art in detecting rare attacks with few training samples. Besides, it can detect unknown network attacks and then label these attacks.

The reliability of Industrial Control Systems (ICS) is crucial given their substantial importance in society and business. These systems are susceptible to physical and cyber-attacks, which can seriously affect human life and the economy. Given the growing prevalence of Internet of Things (IoT) technologies and the possibility of cyber warfare, it is essential to prioritize safeguarding Industrial Control Systems (ICS) from cyberattacks. Previous studies revealed an imbalance in the ICS datasets. As a result, models didn't do well in minority classes but did well in majority classes, which made the intrusion detection system (IDS) less useful. The key objective is to provide insights into the normal functioning of the system and the disruptions produced by cyberattacks. In this study, we introduced an interdisciplinary framework that aims to enhance network intrusion detection systems (NIDSs). In this framework, we introduced an IDS via feature selection and feature reduction technique(s) with the attention-driven lightweight deep neural networks: Deep Recurrent Neural Networks (RNN), Deep Long Short-Term Memory (LSTM), and Deep Bi-directional Long Short-Term Memory (Bi-LSTM). Several feature selection techniques exclude features that fail to match the specified criteria. We employed Sparse Principal Component Analysis (SPCA) to extract higher-order features. We conducted experiments on the three datasets: the Secure Water Treatment System (SWaT), the Water Distribution (WADI), and the Gas Heating Loop (GHL).Among the models used in the framework, the attention-driven Deep LSTM model produced better results than the others, revealing lower training and testing times for the three datasets. In terms of precision, recall, F1-score, computational speed, and ability to work with larger datasets and different ICSs, the proposed framework is better than previous methods in detecting cyberattacks. This highlights how useful it is in the real world.

Widespread use of internet connected devices results in a flow of data among the connected devices. This has led to creating these network systems prone to different type of cyber attacks among which network intrusion is one of a kind. To detect network intrusion, an intrusion detection system (IDS) is placed in the system. The previous works in this field classify the attack mainly with traditional machine learning algorithm based models. This experiment proposes Long Short Term Memory (LSTM) based neural network model along with two other machine learning models i.e. Support Vector Machine (SVM), K-Nearest Neighbor (KNN), which shows significant improved performance in intrusion detection. The performance of the model is proved to be effective comparing to the previous works and also deployable in real life environments which is validated by using explainable AI. For this experiment, Kyoto University Honeypot log dataset has been used to build and evaluate the performances of the IDS model.KeywordsIntrusion detectionLSTMSVMLIMEClass imbalance

Enhancing CNN-based network intrusion detection through hyperparameter optimization

Network Intrusion Detection Systems (NIDS) are critical in ensuring the security of connected computer systems by actively detecting and preventing unauthorized activities and malicious attacks. Machine learning (ML) and deep learning (DL) based NIDS models leverage algorithms that learn from historical network traffic data to identify patterns and anomalies to capture complex relationships. The primary objective of this research is to generate tags and descriptions for the packets that are difficult to classify by the NIDS. Most NIDS datasets that are publicly available have focused on flow data, offering aggregated information about network connections, and have played a crucial role in enabling researchers and network security professionals to design and develop flow-based NIDS solutions. While flow records provide valuable information for detecting network-level anomalies and attacks, they do not consider packet-level information and payload contents. In this research, we propose a packet-level approach for NIDS that leverages the flow information with the packet header fields and payload. To facilitate this research, we have curated a comprehensive Packet-level dataset constructed by extracting the Packet Capture (PCAP) files from two widely used flow-level datasets, namely CIC-IDS2017 and UNSW-NB15. Recent advancements in Natural Language Processing (NLP) have demonstrated the effectiveness of Transformer-based models in handling sequence data with tasks such as token classification and text generation. We have adapted this technology to NIDS to extract key features and characteristics of the header and payload in the context of various attacks. Unlike traditional classification methods that assign predefined labels to network packets, this method focuses on generating tags based on the packet signature that explains the packet content and potential risks. The tags and descriptions offer network security professionals a tool to comprehend suspicious packets with an unfamiliar or potentially malicious signature, assess their nature, and help make informed decisions promptly.

IntroductionIn light of escalating concerns regarding global warming and environmental pollution, the pursuit of carbon neutrality has emerged as a pivotal strategy to address climate change on a global scale. As society becomes increasingly conscious of its ecological impact, various sectors, including sports, are urged to embrace environmental responsibility. This study seeks to explore the integration of a carbon neutral framework utilizing artificial intelligence's attention mechanism within the realm of football, with the aim of contributing to football's adoption of carbon neutrality.MethodsThe study commences by introducing an end-to-end architectural framework capable of unifying and optimizing all facets of football to realize a comprehensive carbon-neutral objective. This architecture serves as a consolidated platform for enhancing carbon emission reduction within football pedagogical activities, fostering synergy among diverse constituents while concurrently assessing the equilibrium between carbon reduction and pedagogical effectiveness. Subsequently, attention mechanisms are leveraged to heighten the efficacy and comprehensibility of carbon-neutral strategies. The application of attention mechanisms enables the model to autonomously focus on attributes or regions closely associated with carbon neutrality objectives, thereby facilitating precision and efficacy in recommending carbon neutral strategies. By employing attention mechanisms in football, a more thorough understanding of carbon emissions' dynamics is attained, allowing for the identification of pivotal emission contributors and tailored suggestions for emission mitigation. Furthermore, the Long Short-Term Memory (LSTM) method is employed to analyze football time-series data. Given football's intricate sequence of actions, the LSTM technique adeptly captures long-term dependencies, offering improved analysis and optimization of carbon emissions during football activities.ResultsThe integrated end-to-end architectural framework offers a holistic approach to carbon-neutral football strategies. Attention mechanisms effectively enhance the focus and interpretation of carbon-neutral strategies, contributing to precise and impactful recommendations. Employing LSTM for time-series analysis aids in comprehending carbon emission dynamics, enabling the identification of efficacious carbon neutral strategies. The study underscores the potential of AI-driven attention mechanisms and LSTM in fostering carbon neutrality within football.DiscussionThe study's findings underscore the viability of integrating AI-driven methodologies, specifically attention mechanisms and LSTM, to promote carbon neutrality within the football domain. The end-to-end architecture serves as a foundational platform for comprehensive carbon emission reduction, offering potential for broader application in other sectors. The combination of attention mechanisms and LSTM engenders deeper insights into carbon emissions' intricate temporal dynamics, informing the development of targeted strategies for emission mitigation. The study's outcomes provide theoretical underpinnings for advancing sustainable football practices and inspire the broader adoption of carbon neutrality principles across diverse domains.

SummaryFor the past few years, Bitcoin plays a vital role in both the economical and financial industries. In order to gain a huge return on investment, the investors are eager to forecast the future value of Bitcoin. However, Bitcoin price variation is quite nonlinear and chaotic in nature, so it creates more difficulty in forecasting future value. Researchers found that the multiplicative long short term memory (LSTM) model will be more efficient for predicting those complex variations. So, target mission is about to develop an optimized multiplicative LSTM with an Attention mechanism using Technical Indicators derived from historical data. A modified cuckoo search optimization model is proposed to tune the hyperparameter of the Deep Learning model. This novel optimization algorithm eliminates the local optimum and slower convergence problem of the cuckoo search optimization algorithm. Deibold Mariano test is performed to statistically evaluate the proposed model and it is inferred that the recommended methodology is statistically fit. Regression metrics such as root mean square error, mean square error and mean absolute error has been used for comparative evaluation with related benchmark techniques such as genetic algorithm optimized LSTM (GA–LSTM), particle swarm optimized LSTM (PSO–LSTM) and cuckoo search optimized LSTM (CSO–LSTM). The empirical result shows that the recommended methodology outperforms the taken benchmark models and provides better accuracy.