ANID-SEoKELM: Adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features

At present, the electric power information system has been more widely used. The power sector in the realization of management information at the same time, its security problems are also increasingly severe. It can be said that the security problem of the electric power information has become a hidden danger to the safe and stable operation of the power system. There is a corresponding intrusion problem in the power information network, which affects the stability and security of the power system to a great extent. Aiming at the problem of a long time and low accuracy of network intrusion detection in the power monitoring systems, this paper proposes a method of network intrusion detection in power monitoring systems based on data mining technology. The method can ensure the safe and stable operation of the power monitoring system. This method needs to extract the data characteristics of network intrusion as the initial data set of intrusion detection method, and then apply the clustering partition method to preprocess the data to provide accurate data basis for intrusion detection method, and finally, based on data mining technology, complete the intrusion detection of power monitoring system network. A simulation experiment is designed to test the feasibility and accuracy of the method, and the experimental results show that, compared with the traditional intrusion detection method, the proposed method is faster by about 1.8s, the intrusion detection accuracy is higher by 15.6% for 500 groups of data, and the false alarm rate is lower by 12.3%. It can be proved that the design method in this paper has high efficiency and accuracy, and can provide technical support for the safe operation of the power system.

In this paper, it presented the method of network intrusion detection based on the neural network GCBP algorithm. By analyzing and comparing the BP algorithm with the GCBP algorithm, what learned is that the GCBP algorithm had overcome the weaknesses, which traditional BP algorithm has of slow convergent speed and easily getting into local minimum. Applicable effects of the method of the intrusion detection are much better, more highly accurate, and greater adaptively. I also showed the ability of more quickly learning. To a great extent, it can achieve the detection of unknown data packets, providing an effective way to efficiently and accurately realize intrusion detection.

This paper proposes an adaptive on-line intrusion detection model based on incremental rule learning. This model can make self-learning over the ever-emerged new network behavior examples and dynamically modify behavior profile of the model, which overcomes the disadvantage that the traditional static detecting model must relearn over all the old and new examples, even can't relearn because of limited memory size. The experiment results validate the feasibility and effectivity of the presented adaptive intrusion detection model.

Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks

In order to improve the security performance and accuracy of the Internet of things in the use process, it is necessary to use the Internet of things intrusion detection method. At present, the problem of inconsistency between the accuracy of detection results and nodes is more prominent when the Internet of things intrusion detection methods are running. This paper proposes a practical Byzantine fault‐tolerant intrusion detection method for the use process of the Internet of things. This method introduces the intrusion detection method and the operation function of foreign attackers on the basis of practical Byzantine fault tolerance; using the expected utility function to the corresponding benefit function of practical Byzantine fault tolerance, the results of Internet of things intrusion detection model can be effectively calculated. Finally, the experimental results show that compared with the existing intrusion detection methods, the proposed method can effectively reduce the energy consumption of the Internet of things in the operation process, can effectively reduce 14.3% and 7.8%, and can effectively reduce the energy consumption of the Internet of things in the operation process.

Network intrusion detection identifies malicious activity in the network by analyzing the behavior of network traffic. As an important part of network intrusion detection, feature extraction plays a crucial role in improving the performance of intrusion detection. This research proposes a novel secondary feature extraction method called L-KPCA based on the Liner Discriminant Analysis (LDA) and Kernel Principal Component Analysis (KPCA), to provide efficient features for network intrusion detection. While maintaining the effectiveness of processing nonlinear data in network traffic, the use of LDA effectively compensates for the problem that KPCA only focuses on the analysis of features in terms of variance and ignores the performance of features in terms of mean. Extensive experimental results verify that the use of the proposed, L-KPCA can make the intrusion detection classification model perform better in terms of recognition accuracy and recall.

Nowadays, by spreading the usage of the Internet, having a secure communication channels for providing a safe network, is needed. Firewalls are not sufficient enough to prevent attacks among computer networks, because internal attacks are incontrollable. For prevention of these internal attacks, unauthorized intrusion detection systems will be used to secure the network. In this paper, firstly, we define data mining methods, and then we look through various attacks and intrusion detections, and base on these matters, we discuss a data mining-based method for network intrusion detection and attack ontologies.

A common problem for network intrusion detection systems is that there are many available features describing network traffic and feature values are highly irregular with burst nature. Some values such as octets transferred range several orders of magnitudes, from several bytes to million bytes. The role of network features depends on which pattern to be detected: normal or intrusive one. Intrusion detection rates would be better if we know which network features are more important for a particular pattern. We therefore propose an automated feature weighting method for network intrusion detection based on a fuzzy subspace approach. Experimental results show that the proposed weighting method can improve the detection rates.

Aimed at the intrusion behaviors are characterized with uncertainty, complexity, diversity and dynamic tendency and the advantages of neural network, an intrusion detection method based on improved simulated annealing neural network (ISANN) is presented in this paper. First the simulated annealing algorithm with the best reserve mechanism is introduced and it is organic combined with Powell algorithm to form improved simulated annealing mixed optimize algorithm, instead of gradient falling algorithm of BP network to train network weight. It can get higher accuracy and faster convergence speed. We construct the network structure, and give the algorithm flow. We discussed and analyzed the impact factor of intrusion behaviors. With the ability of strong self-learning and faster convergence of ISANN, the network intrusion detection method can detect various intrusion behaviors rapidly and effectively by learning the typical intrusion characteristic information. The experimental result shows that this intrusion detection method is feasible and effective.

Intrusion Detection Systems (IDS) are integral to ensuring network security. However, in practical settings, network traffic data often exhibits significant imbalances, affecting both labeled and unlabeled data distributions. Such imbalances notably degrade the performance of existing intrusion detection methods, particularly in semi-supervised learning contexts, where traditional approaches struggle to effectively leverage large amounts of unlabeled data for enhanced detection capabilities. This paper introduces a semi-supervised learning approach based on normalizing flows to mitigate the data imbalance issue in network intrusion detection. Normalizing flows construct flexible and invertible probabilistic models that can accurately capture and generate complex, highdimensional network traffic data distributions. Specifically, this method utilizes a small amount of labeled data for initial training and incorporates manifold learning and self-training with unlabeled data to adapt the model to the imbalance in the unlabeled data distribution, thereby improving overall detection performance. Experimental results demonstrate that this method outperforms traditional approaches in addressing data imbalance in intrusion detection. The proposed method not only improves detection accuracy and recall but also significantly reduces reliance on data distribution assumptions, demonstrating robustness and generalization across diverse network traffic datasets.

In light of the escalating ubiquity of the Internet, the proliferation of cyber-attacks, coupled with their intricate and surreptitious nature, has significantly imperiled network security. Traditional machine learning methodologies inherently exhibit constraints in effectively detecting and classifying multifarious cyber threats. Specifically, the surge in high-dimensional network traffic data and the imbalanced distribution of classes exacerbate the predicament of ideal classification performance. Notably, the presence of redundant information within network traffic data undermines the accuracy of classifiers. To address these challenges, this study introduces a novel approach for intrusion detection classification which integrates advanced techniques of feature engineering and model optimization. The method employs a feature engineering approach that leverages mutual information maximum correlation minimum redundancy (mRMR) feature selection and synthetic minority class oversampling technique (SMOTE) to process network data. This transformation of raw data into more meaningful features effectively addresses the complexity and diversity inherent in network data, enhancing classifier accuracy by reducing feature redundancy and mitigating issues related to class imbalance and the detection of rare attacks. Furthermore, to optimize classifier performance, the paper applies the Optuna method to fine-tune the hyperparameters of the Catboost classifier, thereby determining the optimal model configuration. The study conducts binary and multi-classification experiments using publicly available datasets, including NSL_KDD, UNSW-NB15, and CICIDS-2017. Experimental results demonstrate that the proposed method outperforms traditional approaches regarding accuracy, recall, precision, and F-value. These findings highlight the method’s potential and performance in network intrusion detection.

Along with the steady growth of wired and wireless networks, the various new attacks targeting networks are also constantly emerging and transforming. As a efficient way to cope with various attacks, the Random Forest(RF) algorithm has frequently been used as the core engine of intrusion detection because of the faster learning speed and the higher attack detection accuracy. However, the RF algorithm has to input the number of the tree composing the forest as a parameter. In this paper, we proposed a new algorithm that limit the number of trees composing the forest using the McNemar test. To evaluate the performance of the proposed RF algorithm, we compared learning time, accuracy and memory usage of the proposed algorithm with the original RF algorithm and other algorithm by using the KDDcup99 dataset. Under the same detection accuracy, the proposed RF algorithm improves the performance of the original RF algorithm by as much as 97.76% at learning time, 91.86% at test time, and 99.02% in memory usage on average.

The paper presents the application of the artificial immune systems apparatus as a heuristic method of network intrusion detection for algorithmic provision of intrusion detection systems. The coevolutionary immune algorithm of artificial immune systems with clonal selection was elaborated. In testing different datasets the empirical results of evaluation of the algorithm effectiveness were achieved. To identify the degree of efficiency the algorithm was compared with analogs. The fundamental rules based of solutions generated by this algorithm are described in the article.

Network intrusion datasets often face class imbalance issues in intrusion detection tasks, where the number of majority class samples is much higher than minority class samples. Current solutions face notable limitations: traditional normalization weakens the multimodal distribution of continuous features, while mainstream generative models focus excessively on minority class mining while neglecting majority class information. To address these issues, we propose M2M-VAEGAN, which innovatively incorporates a Variational Gaussian Mixture (VGM) model to preserve multimodal characteristics of continuous features. We design a transfer learning framework, pre-training on majority classes to capture general attack patterns, followed by fine-tuning with balanced batches of majority and minority samples to prevent catastrophic forgetting. Additionally, we enhance the VAEGAN architecture with an auxiliary classifier to strengthen conditional information learning. On the NSL-KDD and CIC-IDS2017 datasets, M2M-VAEGAN outperforms methods such as SMOTE, CTGAN, and CTABGAN, achieving a 1.25% to 6.42% improvement in minority class recall. These results demonstrate the effectiveness of the proposed approach.

The increasing application of machine learning to network intrusion detection has shown great successes in the recent years. To reduce the high dimension of captured network records for classifiers to learn efficiently, various feature reduction methods have been proposed. Using the Information Bottleneck framework, a concise and discriminative feature representation can be derived by optimizing an intuition and theoretically grounded objective function. In this paper, we propose a novel Variational Information Bottleneck method for Network Intrusion Detection that can produce high-quality low-dimensional representation to increase the classification accuracy of conventional machine learning classifier. Moreover, the proposed model is shown to achieve promising accuracy scores in comparison to several state-of-the-art anomaly-based IDS, on both the 2-class classification and 5-class classification intrusion detection problem.