An Intrusion Detection System for Identifying Simultaneous Attacks using Multi-Task Learning and Deep Learning

An intrusion detection system (IDS) is an important protection instrument for detecting complex network attacks. Various machine learning (ML) or deep learning (DL) algorithms have been proposed for implementing anomaly-based IDS (AIDS). Our review of the AIDS literature identifies some issues in related work, including the randomness of the selected algorithms, parameters, and testing criteria, the application of old datasets, or shallow analyses and validation of the results. This paper comprehensively reviews previous studies on AIDS by using a set of criteria with different datasets and types of attacks to set benchmarking outcomes that can reveal the suitable AIDS algorithms, parameters, and testing criteria. Specifically, this paper applies 10 popular supervised and unsupervised ML algorithms for identifying effective and efficient ML-AIDS of networks and computers. These supervised ML algorithms include the artificial neural network (ANN), decision tree (DT), k-nearest neighbor (k-NN), naive Bayes (NB), random forest (RF), support vector machine (SVM), and convolutional neural network (CNN) algorithms, whereas the unsupervised ML algorithms include the expectation-maximization (EM), k-means, and self-organizing maps (SOM) algorithms. Several models of these algorithms are introduced, and the turning and training parameters of each algorithm are examined to achieve an optimal classifier evaluation. Unlike previous studies, this study evaluates the performance of AIDS by measuring the true positive and negative rates, accuracy, precision, recall, and F-Score of 31 ML-AIDS models. The training and testing time for ML-AIDS models are also considered in measuring their performance efficiency given that time complexity is an important factor in AIDSs. The ML-AIDS models are tested by using a recent and highly unbalanced multiclass CICIDS2017 dataset that involves real-world network attacks. In general, the k-NN-AIDS, DT-AIDS, and NB-AIDS models obtain the best results and show a greater capability in detecting web attacks compared with other models that demonstrate irregular and inferior results.

In machine learning, the relatedness across multiple tasks is usually complex and entangled. Due to dataset bias, the relatedness among tasks might be distorted and mislead the training of the models with solid learning ability, such as the multi-task neural networks. In this paper, we propose the idea of Relatedness Refinement Multi-Task Learning (RRMTDL) by introducing adversarial learning in the multi-task deep neural network to tackle the problem. The RRMTDL deep learning model restrains the misleading relatedness task by adversarial training and extracts information sharing across tasks with valuable relatedness. With RRMTDL, multi-task deep learning can enhance the task-specific representation for the major tasks by excluding the misleading relatedness. We design tests with various combinations of task-relatedness to validate the proposed model. Experimental results show that the RRMTDL model can effectively refine the task relatedness and prominently outperform other multi-task deep learning models in datasets with entangled task labels.

Nowadays, along with network development, due to the threats of unknown sources, information communication is more vulnerable, and thus, more secured information is required. Intrusion Detection System (IDS) is very important for cybersecurity with the presence in particular of various networked computers' foundation. An efficient IDS apply machine learning method as computational technics to increase rates of detection to gain the high accuracy and low false alarms rate within the huge amounts of data. To increase the rate of detection, researcher usually implements the optimizer. Thus, in this research, a comprehensive experimental study is presented based on various binary to optimize the rate of detection and decrease the error. Moreover, Numerous researches have been conducted about intrusion detection systems with the old dataset such as Kddcup'99 dataset, and due to this reason, most of them did not get the potential accuracy to detect intrusion with the current intrusion as the old dataset is not covering the current attacks. Therefore, this research aims to A hybrid Anomaly Classification of IDS with Deep Learning (DL) and Binary Algorithms (BA) as Optimizer with the most updated dataset named "CICIDS2017" which can be used for the intrusion detection evaluation. Moreover, this research conducts the anomaly classification of IDS based on the deep neural network (DNN) as the Deep Learning (DL) platform and Binary Algorithms (BA) in terms of Binary Bat Algorithm (BBA), Binary Genetic Algorithm (BGA), Binary Gravitational Search Algorithm (BGSA) as optimizer to enhance the rates of detection. Some of the results which had been considered and achieved for DNN and the hybrid version (DNN and Binary Algorithms) are in terms of: Accuracy, Recall, Precision, Confusion Matrix, Sensitivity, Specificity, and Cost Error.

The aim of this study is to develop a predictive model utilizing deep learning and machine learning techniques that will inform clinical decision-making by predicting the 1-year postoperative recovery of patients with lumbar disk herniation. The clinical data of 470 inpatients who underwent tubular microdiscectomy (TMD) between January 2018 and January 2021 were retrospectively analyzed as variables. The dataset was randomly divided into a training set (n = 329) and a test set (n = 141) using a 10-fold cross-validation technique. Various deep learning and machine learning algorithms including Random Forests, Extreme Gradient Boosting, Support Vector Machines, Extra Trees, K-Nearest Neighbors, Logistic Regression, Light Gradient Boosting Machine, and MLP (Artificial Neural Networks) were employed to develop predictive models for the recovery of patients with lumbar disk herniation 1 year after surgery. The cure rate score of lumbar JOA score 1 year after TMD was used as an outcome indicator. The primary evaluation metric was the area under the receiver operating characteristic curve (AUC), with additional measures including decision curve analysis (DCA), accuracy, sensitivity, specificity, and others. The heat map of the correlation matrix revealed low inter-feature correlation. The predictive model employing both machine learning and deep learning algorithms was constructed using 15 variables after feature engineering. Among the eight algorithms utilized, the MLP algorithm demonstrated the best performance. Our study findings demonstrate that the MLP algorithm provides superior predictive performance for the recovery of patients with lumbar disk herniation 1 year after surgery.

Over the past few years, Internet applications have become more advanced and widely used. This has increased the need for Internet networks to be secured. Intrusion detection systems (IDSs), which employ artificial intelligence (AI) methods, are vital to ensuring network security. As a branch of AI, deep learning (DL) algorithms are now effectively applied in IDSs. Among deep learning neural networks, the convolutional neural network (CNN) is a well-known structure designed to process complex data. The CNN overcomes the typical limitations of conventional machine learning approaches and is mainly used in IDSs. Several CNN-based approaches are employed in IDSs to handle privacy issues and security threats. However, there are no comprehensive surveys of IDS schemes that have utilized CNN to the best of our knowledge. Hence, in this study, our primary focus is on CNN-based IDSs so as to increase our understanding of various uses of the CNN in detecting network intrusions, anomalies, and other types of attacks. This paper innovatively organizes the studied CNN-IDS approaches into multiple categories and describes their primary capabilities and contributions. The main features of these approaches, such as the dataset, architecture, input shape, evaluated metrics, performance, feature extraction, and classifier method, are compared. Because different datasets are used in CNN-IDS research, their experimental results are not comparable. Hence, this study also conducted an empirical experiment to compare different approaches based on standard datasets, and the comparative results are presented in detail.

Early detection and timely surgical intervention are crucial in reducing mortality rates associated with clinically significant prostate cancer (csPCa). Currently, clinical diagnostics primarily depend on magnetic resonance imaging (MRI) and nuclear medicine, with the potential diagnostic value of abdominal computed tomography (CT) remaining underexplored. This study aims to evaluate the effectiveness of multi-task deep learning neural networks in identifying early-stage prostate cancer using CT scans. In this study, we enrolled 539 patients from the Department of Radiology (N=461) and Nuclear Medicine (N=78). We utilized a multi-task deep learning network model (MTDL), based on the 3DUnet architecture, to segment and analyze the collected abdominal plain CT images. The predictive performance of this model was compared with a radiomics model and a single-task deep learning model using ResNet18. A diagnostic nomogram was then developed using the multi-task deep learning approach, incorporating prediction results and PSAD, age. The diagnostic performance of the different models was evaluated using the receiver operating characteristic (ROC) curve and the area under the curve (AUC). The 461 patients from the Department of Radiology were divided into training and test sets at a ratio of 6:4, while the patients from the Department of Nuclear Medicine formed the validation set. Our MTDL nomogram demonstrated AUCs of 0.941 (95% confidence interval [CI]: 0.905valceedi 0.912 (95% CI: 0.904valceedi and 0.932 (95% CI: 0.883valceed in the training, test, and validation cohorts, respectively. This study indicates that combining abdominal CT with a multi-task neural network model effectively diagnoses csPCa, offering superior diagnostic performance compared to clinical models. Additionally, the multi-task neural network model outperformed both the single-task neural network model and the radiomics model in diagnostic accuracy. Our study demonstrated that the MTDL nomogram can accurately predict the presence of prostate cancer using abdominal CT scans, offering significant value for the early diagnosis of prostate cancer.

Data security is regarded to be one of the crucial challenges in this fast-growing internet world. Data generated through internet is exposed to various types of vulnerabilities and exploits. Security mechanisms such as Intrusion Detection System (IDS) are designed to detect various types of vulnerabilities and attacks. Various Machine Learning (ML) and Deep Learning (DL) techniques are used for building IDS. In this paper, we aim to build Deep Neural Network (DNN)-based IDS for attack detection and classification. DNN technique has certain challenges such as complex network structure, co-adaptation of feature vectors, over-fitting, to name a few. We aim to address these challenges by using AntiRectifier layer and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian Noise. In this paper, we have evaluated DNN-based IDS using NSL-KDD, UNSW_NB-15 and CIC-IDS-2017 dataset. The experimental results show that DNN-based IDS with AntiRectifier layer outperforms compared to ML techniques such as Decision Tree (DT), Random Forest (RF), Naïve Bayes (NB), Support Vector Machine (SVM), k-Nearest Neighbours (k-NN) and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian noise in terms of accuracy, precision, recall, f-score, and false positive rate.

To develop and validate a multi-task deep learning (MTDL) model using multiphase contrast-enhanced CT (CECT) for simultaneously assessing histological subtypes, clinical stages, and anatomical complexity grades of solid malignant renal tumors. This two-center retrospective study included patients with solid malignant renal tumors and their preoperative kidney CECT images. A progressive layered extraction (PLE)-based MTDL model was trained and externally tested. Model performance was evaluated using the area under the receiver operating characteristic curve (AUC) and decision curve analysis (DCA), compared with the results of five radiologists. Among 798 patients (mean age, 54 ± 12 years; 279 females; Center A: n = 620, Center B: n = 178), 597 (74.8%) had clear cell renal cell carcinomas (ccRCC), 150 (18.8%) were clinical staging III/IV, and 187 (23.4%) had high anatomical complexity. On the external test set, the MTDL model achieved AUCs of 0.89 (95% CI: 0.82, 0.94) for distinguishing ccRCC from non-ccRCC, 0.87 (95% CI: 0.81, 0.93) for clinical staging (I/II vs. III/IV), and 0.87 (95% CI: 0.82, 0.92) for anatomical complexity grading (low-intermediate vs. high). The MTDL model outperformed single-task deep learning (STDL) in clinical staging (AUC: 0.87 vs. 0.82, p = 0.022), showed higher net benefit on DCA, and demonstrated better diagnostic performance than junior radiologists in histological subtyping and clinical staging. Additionally, it used 68% less memory and was 60% faster than STDL models. The CECT-based MTDL model demonstrated robust performance in simultaneously predicting histological subtypes, clinical stages, and anatomical complexity grades of malignant renal tumors. Question Accurate preoperative description of the histological subtyping, clinical staging, and anatomical complexity of malignant renal tumors is crucial for treatment decision-making. Findings By sharing features, the multi-task deep learning algorithm model enhances clinical staging performance and significantly improves computational efficiency in predicting all three tasks simultaneously. Clinical relevance The multi-task deep learning algorithm model enables rapid and accurate comprehensive preoperative evaluation of renal tumors, which assists surgeons in optimizing surgical plans and promotes the advancement of renal tumor management toward precision and efficiency.

The aim of this study was to determine the invasiveness of ground-glass nodules (GGNs) using a 3D multi-task deep learning network. We propose a novel architecture based on 3D multi-task learning to determine the invasiveness of GGNs. In total, 770 patients with 909 GGNs who underwent lung CT scans were enrolled. The patients were divided into the training (n = 626) and test sets (n = 144). In the test set, invasiveness was classified using deep learning into three categories: atypical adenomatous hyperplasia (AAH) and adenocarcinoma in situ (AIS), minimally invasive adenocarcinoma (MIA), and invasive pulmonary adenocarcinoma (IA). Furthermore, binary classifications (AAH/AIS/MIA vs. IA) were made by two thoracic radiologists and compared with the deep learning results. In the three-category classification task, the sensitivity, specificity, and accuracy were 65.41%, 82.21%, and 64.9%, respectively. In the binary classification task, the sensitivity, specificity, accuracy, and area under the ROC curve (AUC) values were 69.57%, 95.24%, 87.42%, and 0.89, respectively. In the visual assessment of GGN invasiveness of binary classification by the two thoracic radiologists, the sensitivity, specificity, and accuracy of the senior and junior radiologists were 58.93%, 90.51%, and 81.35% and 76.79%, 55.47%, and 61.66%, respectively. The proposed multi-task deep learning model achieved good classification results in determining the invasiveness of GGNs. This model may help to select patients with invasive lesions who need surgery and the proper surgical methods. • The proposed multi-task model has achieved good classification results for the invasiveness of GGNs. • The proposed network includes a classification and segmentation branch to learn global and regional features, respectively. • The multi-task model could assist doctors in selecting patients with invasive lesions who need surgery and choosing appropriate surgical methods.

To achieve more effective solution for large-scale image classification (i.e., classifying millions of images into thousands or even tens of thousands of object classes or categories), a deep multi-task learning algorithm is developed by seamlessly integrating deep CNNs with multi-task learning over the concept ontology, where the concept ontology is used to organize large numbers of object classes or categories hierarchically and determine the inter-related learning tasks automatically. Our deep multi-task learning algorithm can integrate the deep CNNs to learn more discriminative high-level features for image representation, and it can also leverage multi-task learning and inter-level relationship constraint to train more discriminative tree classifier over the concept ontology and control the inter-level error propagation effectively. In our deep multi-task learning algorithm, we can use back propagation to simultaneously refine both the relevant node classifiers (at different levels of the concept ontology) and the deep CNNs according to a joint objective function. The experimental results have demonstrated that our deep multi-task learning algorithm can achieve very competitive results on both the accuracy and the cost of feature extraction for large-scale image classification.

Due to the recent advances in the Internet and communication technologies, network systems and data have evolved rapidly. The emergence of new attacks jeopardizes network security and make it really challenging to detect intrusions. Multiple network attacks by an intruder are unavoidable. Our research targets the critical issue of class imbalance in intrusion detection, a reflection of the real-world scenario where legitimate network activities significantly out number malicious ones. This imbalance can adversely affect the learning process of predictive models, often resulting in high false-negative rates, a major concern in Intrusion Detection Systems (IDS). By focusing on datasets with this imbalance, we aim to develop and refine advanced algorithms and techniques, such as anomaly detection, cost-sensitive learning, and oversampling methods, to effectively handle such disparities. The primary goal is to create models that are highly sensitive to intrusions while minimizing false alarms, an essential aspect of effective IDS. This approach is not only practical for real-world applications but also enhances the theoretical understanding of managing class imbalance in machine learning. Our research, by addressing these significant challenges, is positioned to make substantial contributions to cybersecurity, providing valuable insights and applicable solutions in the fight against digital threats and ensuring robustness and relevance in IDS development. An intrusion detection system (IDS) checks network traffic for security, availability, and being non-shared. Despite the efforts of many researchers, contemporary IDSs still need to further improve detection accuracy, reduce false alarms, and detect new intrusions. The mean convolutional layer (MCL), feature-weighted attention (FWA) learning, a bidirectional long short-term memory (BILSTM) network, and the random forest algorithm are all parts of our unique hybrid model called MCL-FWA-BILSTM. The CNN-MCL layer for feature extraction receives data after preprocessing. After convolution, pooling, and flattening phases, feature vectors are obtained. The BI-LSTM and self-attention feature weights are used in the suggested method to mitigate the effects of class imbalance. The attention layer and the BI-LSTM features are concatenated to create mapped features before feeding them to the random forest algorithm for classification. Our methodology and model performance were validated using NSL-KDD and UNSW-NB-15, two widely available IDS datasets. The suggested model's accuracies on binary and multi-class classification tasks using the NSL-KDD dataset are 99.67% and 99.88%, respectively. The model's binary and multi-class classification accuracies on the UNSW-NB15 dataset are 99.56% and 99.45%, respectively. Further, we compared the suggested approach with other previous machine learning and deep learning models and found it to outperform them in detection rate, FPR, and F-score. For both binary and multiclass classifications, the proposed method reduces false positives while increasing the number of true positives. The model proficiently identifies diverse network intrusions on computer networks and accomplishes its intended purpose. The suggested model will be helpful in a variety of network security research fields and applications.

In recent years, multitask learning has turned out to be of great success in various applications. Though single task model training has promised great results throughout these years, it ignores valuable information which might help in estimating better learning parameters. By virtue of learning-related tasks, multitask learning has been able to generalize the models even better. In this paper, we try to enhance the feature mapping of multitask deep learning models by sharing features among related tasks and inductive transfer learning. We have explored the learning of task relationship among various tasks for acquiring more benefits from multitask learning. The proposed enhanced model is compared with two state-of-the-art multitask deep learning models, namely Hyperface and FaceNet. The results show better performance of the proposed model in predicting age, gender and ethnicity on the UTK face dataset.KeywordsNeural networksMultitask deep learningDeep learningRecurrent neural networksConvolution neural networks

In this paper, Big Data and Deep Learning Techniques are integrated to improve the performance of intrusion detection systems. Three classifiers are used to classify network traffic datasets, and these are Deep Feed-Forward Neural Network (DNN) and two ensemble techniques, Random Forest and Gradient Boosting Tree (GBT). To select the most relevant attributes from the datasets, we use a homogeneity metric to evaluate features. Two recently published datasets UNSW NB15 and CICIDS2017 are used to evaluate the proposed method. 5-fold cross validation is used in this work to evaluate the machine learning models. We implemented the method using the distributed computing environment Apache Spark, integrated with Keras Deep Learning Library to implement the deep learning technique while the ensemble techniques are implemented using Apache Spark Machine Learning Library. The results show a high accuracy with DNN for binary and multiclass classification on UNSW NB15 dataset with accuracies at 99.16% for binary classification and 97.01% for multiclass classification. While GBT classifier achieved the best accuracy for binary classification with the CICIDS2017 dataset at 99.99%, for multiclass classification DNN has the highest accuracy with 99.56%.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The rapid growth of the Internet and information technologies and also the diminution of the price of hardware components like wireless sensors leads to the fast growth in Wireless Sensor Network (WSN). The WSN is a bunch/group of sensors that are located across the area, in order to monitor and determine environmental conditions such as temperature, humidity, vibrations, wind, water levels, pollution levels. WSNs are susceptible to major attacks like Denial of Service (DOS), Wormhole attack, Sinkhole attack, etc. The main threat to the WSN is because of the broadcast nature of the nodes in the network. Therefore, the security of WSNs is the essential part that must be done. Hence, to overcome these problems or threats, we are trying to detect it using AI technology. With the expanding fields of Machine Learning and Deep Learning, we can apply various algorithms in order to classify different types of attacks. Once we detect the attack properly, we can prevent it accordingly. We are using WSN-DS. It has 4 classes of attacks which are Grayhole, Blackhole, TDMA(Scheduling), and Flooding which comes under the category of DOS attacks. In this chapter, we have analysed and compared the accuracies of 5 main machine learning classification algorithms. Also, we have analysed the 1 deep learning algorithm. The ANN (Artificial Neural Network) and 5 machine learning algorithms have been trained on the dataset. Furthermore, we have used K-fold cross-validation to get even more accurate predictions. After analysis of these algorithms, we came to the point that, the Machine Learning algorithms like Random Forest, Support Vector Machines and Deep Learning algorithm, namely, Artificial Neural Network can help us for detecting intrusions in the system or network. This will help researchers in designing their own machine learning model on top of our suggested model.