Chapter 9 - Intrusion Detection Systems: Theory

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

The Intrusion Detection System (IDS) is a useful infiltration detection tool. With IDS, it may mechanically categorize intrusions, attacks, or breaches of security stratagems across host-level within the network and within the organization. The Krill Herd Optimized Deep Neural Network (KH-DNN) is proposed in this document as a multiclass cyberattack methodology. This model is suggested by uniting the network-based intrusion detection system (NIDS) and the host-based intrusion detection system (HIDS) to advance flexible and actual IDS to categorize and detect unexpected and unpredictable cyber attacks. In this method, two types of IDS are classified, that is, NIDS and HIDS. Classification of the system call is exploited to discriminate behavior into normal and attack categories. In this manuscript accuracy, the parameter of the deep neural network classifier is optimized with the Krill Herd optimization algorithm. Finally, the DNN model is performed in the NIDS dataset and the HIDS dataset. For the HIDS dataset, the KDD Cup 99 dataset was used, which employed two datasets: ADFA-LD and ADFA-WD, and several types of attacks were detected and classified, including Adduser, Hydra-FTP, Java-Meterpreter, Hydra-SSH, and Web-Shell. The suggested IDS-KH-DNN algorithm attains higher accuracy 42.56% and 23.4%, high precision 84.74% and 52.43%, high F-score 53.5% 64.455, high sensitivity 33.4% and 45.23%, and high specificity 31.45% and 44.23% for the NIDS dataset. The proposed system is compared to two current processes: intrusion detection using Gray Wolf optimization-based support vector machine (IDS-GWO-SVM) and intrusion detection using artificial bee colony optimization algorithm based support vector machine (IDS-ABCO-SVM). Finally, the simulation results show that the suggested approach is capable of quickly and accurately locating optimal solutions.

Cloud computing has gained an extreme importance nowadays. Every organization is getting attracted toward the Cloud computing due to its attractive features like cost saving, adaptability, etc. Although it offers the attractive features but still Cloud threats need great consideration. The insider threat is critically challenging in the Cloud-based environments. In order to mitigate from insider attacks in Clouds, the use of Intrusion detection system (IDS) is quite challenging. Every type of IDS has different methods of attack detection. So, single IDS cannot guarantee the protection from all types of attacks. Thus, in this paper, we have studied the various types of IDS and their features which made them either suitable or unsuitable for cloud computing. Also on the basis of review, required features for the Cloud-based IDS are identified.

In Network-based Intrusion Detection, signatures discovery is an important issue, since the performance of an intrusion detection system heavily depends on accuracy and abundance of signatures. In most cases, we have to find these signatures manually. This is a time-consuming and error-prone work. Some papers introduce data mining into Intrusion Detection System. However, there are some drawbacks in these schemes. We present a data mining based approach to supporting signature discovery in network-based Intrusion Detection System. It has people find signatures of an intrusion easily. The main idea is that: First, Signature Discovery System (SDS) tries to find the most possible signatures that occur very frequently in the communication monitored. Second, SDS will find the relationships between these candidate signatures and construct rules based on these relationships found. Finally, SDS gives two kinds of hints: one is the signatures whose frequency of occurrence is greater than a threshold; the other is a set of rules composed of a set of signatures that are created by SDS in the second step. An experimental system called SigSniffer has been implemented to test the feasibility of the proposed approach.

: Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. One alternative to NIDSs, host-based intrusion detection systems (HIDSs), provides some of the functionality of NIDSs but with limitations. HIDSs cannot perform a network-wide analysis and can be subverted if a host is compromised. We propose an approach to intrusion detection that combines HIDS, NIDS, and a version of IPsec that encrypts the header and the body of IP packets separately. We refer to the latter generically as TwoKey IPsec. We show that all of the network events currently detectable by the Snort NIDS on un- encrypted network traffic are also detectable on encrypted network traffic using this approach. The NIDS detects network-level events that HIDSs have trouble detecting and HIDSs detect application-level events that can't be detected by the NIDS.

Identifying threats contained within encrypted network traffic poses a great challenge to Intrusion Detection Systems (IDS). Because traditional approaches like deep packet inspection could not operate on encrypted network traffic, machine learning-based IDS is a promising solution. However, machine learning-based IDS requires enormous amounts of statistical data based on network traffic flow as input data and also demands high computing power for processing, but is slow in detecting intrusions. We propose a lightweight IDS that transforms raw network traffic into representation images. We begin by inspecting the characteristics of malicious network traffic of the CSE-CIC-IDS2018 dataset. We then adapt methods for effectively representing those characteristics into image data. A Convolutional Neural Network (CNN) based detection model is used to identify malicious traffic underlying within image data. To demonstrate the feasibility of the proposed lightweight IDS, we conduct three simulations on two datasets that contain encrypted traffic with current network attack scenarios. The experiment results show that our proposed IDS is capable of achieving 95% accuracy with a reasonable detection time while requiring relatively small size training data.

An intrusion detection system (IDS) is an essential component of any modern network. The purpose of an IDS is to detect intrusion and generate appropriate alarms so that the intrusion can be mitigated. Implementing an IDS in a Software Defined Network (SDN) is easier since an SDN controller has a centralized view of the whole network. Researchers have made many efforts to use machine learning (ML) for developing network-based IDS in SDN. The network-based IDS analyzes different characteristics of incoming network traffic to detect intrusion. Early detection of intrusion is crucial for an IDS because if the intrusion is not detected quickly enough, it can cause severe damage, such as data breaches and service shutdowns. This paper focuses on detecting intrusion in SDN as early as possible using real-time flow-based features. Our aim is to detect intrusion with less amount of packets per flow, which not only facilitates early intrusion detection but also is useful when an intrusion flow has less number of packets. We show that although ML models perform well in offline training on a dataset, their performance decreases ~25% when fewer packets are used to generate features for the ML model. In all our experiments, a simple Random Forest (RF) algorithm outperforms a complex deep learning model on a publicly available dataset for intrusion detection in SDN.

Basic Security Concepts - Why is Computer and Network Security Important. Background and History. The Security Trinity. Information Security. Risk Assessment. Security Models. Basic Terminology. More Basic Terminology. Threats, Vulnerabilities and Attacks - Protocols. The OSI Reference Model. TCP/IP Protocol Suite. Useful Web Sites. Search Engines. Mailing Lists. Encryption, Digital Signatures and Certification - Cryptography. Stream Ciphers. Breaking Ciphers. Block Ciphers. Encryption. Public Key Cryptosystems. Message Integrity. Authentication. Digital Signatures. Competing Standards. Digital Certificates. Limitations of Digital Certificates. Certificate Authorities. Public Key Infrastructure. The Future. The Limitations of Encryption. Kerberos - How Kerberos Works. Kerberos- Limitations. Encryption on the WWW - The World Wide Web. Secure Sockets Layer (HTTPS). Secure HTTP (SHTTP). Microsoft's Internet Explorer. Viewing Digital Certificates with Internet Explorer. Viewing the Encryption Strength of IE5. Viewing Certification Authorities with IE5. Netscape Navigator. Viewing Digital Certificates with Navigator. Authenticode Certificates. E-Mail - E-Mail Issues. E-Mail Issues. Secure E-Mail Protocols. Web-Based E-Mail Services. Security of Stored Messages. Identity: Spoofing and Hiding. E-Mail as a weapon. E-Mail Policies. E-Mail Privacy. Auto-Responses. Operating System Security -- Passwords. Password Attacks. Onetime Passwords. Access Control. Data Redundancy. General Recommendations. Modems. Useful Tools. LAN Security - LAN Guidelines. Controlling End-User Access. Concurrent Logins. Available Disk Space. Restrictions to Location or Workstation. Time/Day Restrictions. Access to Directories and Trustee Rights. File Attributes. Other Privileges. Single Sign-On. Policy-Based Network Management. Honeypot Systems. Network Segmentation. Static IP Addresses vs. DHCP. Media and Protocols - Network Media. Plenum Cabling and Risers. WANs. Redundancy and Alternative Connections. Routers and SNMP - Router Issues. SNMP. Virtual Private Networks - Encryption on the Network. Node-to-Node Encryption. End-to-End Encryption. Where to Encrypt. Virtual Private Networks. PPTP. L2TP. IPSec. SOCKS. Firewalls - Firewalls Pros and Cons. Types of Firewalls. Packet Filters vs. Proxies. Firewall Configurations. Restricting Users' Access to the Internet. Firewall Products. Personal Firewalls. Biometrics - Identification and Authentication. Biometric Identification and Authentication. Biometric Identification Reliability. Backup Authentication. Environmental Conditions. User Acceptance. Security of the Biometric System. Interoperability. Costs vs. Savings. Policies and Procedures - Policies vs. Procedures. Information Security Policy Objectives. Developing Security Policies. Policy and Procedure Manuals. Policy Awareness & Education. Policy Enforcement. Policy Format. Security Policy Suggestions. Information Protection Team. Crisis Management Planning. Sources for Information Policies. Auditing and Intrusion Detection - What is an Audit. Operational Security Audits. System Security Auditing. Activity and Usage Auditing. Audit Mistakes. Deficiencies of Traditional Audit Techniques. Intrusion Detection. Intrusion Detection Systems. Host-Based Intrusion Detection Systems. Network-Based Intrusion Detection Systems. Knowledge-Based Intrusion Detection Systems. Statistical-Based Intrusion Detection Systems. Defense In-Depth Approach . Future Directions. Crisis Management Planning - Crisis Management. Disaster Recovery Planning. Computer Security Incident Response Plan. Browser Security - Cookie Files. Cache Files. Autocomplete.

Recent advancements in technology, particularly in artificial intelligence (AI) and machine learning (ML), have significantly enhanced connectivity and efficiency in various domains. However, these developments have also led to increased threats and concerns regarding cyberattacks which have significantly challenged governments, businesses, and societies. An Intrusion Detection System (IDS) is a critical component of a cybersecurity architecture that is designed to monitor and analyze network traffic for signs of malicious activity and plays an essential role in detecting and responding to security threats. The increasing complexity of security attacks has led researchers to use machine learning (ML) and deep learning (DL) methods to enhance IDS performance. These cutting-edge systems are designed to detect emerging cyberthreats. The current study investigates and compares various types of IDS and AI-based techniques that use ML and DL algorithms to protect data against malicious threats. It also provides an overview of the architecture and operation of IDS and examines popular datasets such as CIC-IDS2017, KDDCup99 and UNSW-NB15 used to evaluate IDS models. These datasets offer a diverse range of attack scenarios and normal traffic and help create a more reliable and effective IDS which improves the overall network security. The study concludes by emphasizing constant progress in IDS technologies to combat evolving cyberthreats and enhance network security.

In this work, a Behaviour-based Intrusion Detection Model is suggested. The proposed model can be employed from a single host configuration to a distributed mixture of host-based and network-based Intrusion Detection Systems (IDSs). Unlike most state-of-the-art IDSs that rely on analysing lower-level, raw-data representations, our proposed architecture suggests to use higher-level notions -behaviours- instead; this way, the IDS is able to identify more sophisticated attacks. To assess our premise, a Behaviour-based IDS (BIDS) prototype has been designed and developed that scans file system data to identify attacks. BIDS achieves high detection rates with low corresponding false positive rates, superseding other state-of-the-art file system IDSs.

With the advancement of internet technologies comes the need for systems that can ensure the security of a network. An intrusion Detection System (IDS) can detect and sometimes take action against malicious network traffic. There are different types of IDS. For example, based on the detection method, it can be Signature-based IDS or Anomaly-based IDS or Hybrid IDS. In this work, multiple models are trained using various machine learning algorithms on the NSL-KDD dataset to build an efficient anomaly-based IDS that can detect malicious traffic with utmost accuracy. Supervised Learning algorithms like Logistic Regression, Decision Tree, K-Nearest Neighbour (KNN), XGBoost, Random Forest and Multilayer Perceptron (MLP) are used. At last, the Hard Voting technique is employed to increase efficiency.

LIO-IDS: Handling class imbalance using LSTM and improved one-vs-one technique in intrusion detection system

Network security breaches continue to grow in both complexity and impact, making intrusion detection a critical component of modern defense strategies. Intrusion Detection Systems (IDS) monitor system and network activity to identify malicious behavior and stop it before causing harm. causes harm. Among them, Network-based IDS (NIDS) is particularly important because it analyzes network traffic at the packet or flow level, enabling protection across a wide range of infrastructure. Deep Learning (DL) has recently emerged as a transformative approach for NIDS by learning complex representations of normal and malicious traffic patterns without the need for extensive manual feature engineering. This survey provides a review of recent progress in DL for NIDS and introduces a taxonomy with four categories. These include reconstruction and generative models that detect anomalies, Transformer-based sequence models for capturing temporal dependencies, convolutional and deep neural networks for supervised classification, and hybrid or deployment-oriented approaches that combine techniques or support real-world deployment needs. This survey reviews 31 studies published between 2020 and 2025, covering their datasets, feature sets, model architectures, and reported performance. A comparative analysis highlights common practices and emerging trends. Finally, we identify open challenges related to data quality, scalability, adversarial robustness, privacy, and interpretability, and we outline promising directions for future research. This work contributes an updated review, a structured framework for comparison, and practical insights to guide the development of more secure and effective NIDS.

In network-based intrusion detection, signatures discovery is an important issue, since the performance of an intrusion detection system heavily depends on accuracy and abundance of signatures. In most cases, we have to find these signatures manually. This is a time-consuming and error-prone work. We present a data mining method based on an approach to support signature discovery in a network-based intrusion detection system, which generates signatures for a misuse detection intrusion detection system (IDS) not only depending on associations of attributes of the transfer protocol, but also on the content of traffic. Until now, no paper has studied how to mine content of traffic to generate signatures for an IDS. Our work allows people to find signatures of an intrusion easily and provides a third party IDS (for example, Snort) with candidate signatures. In order to discover signatures, we present an algorithm called Signature Apriori. An experimental system named SigSniffer has been implemented to test the feasibility of the proposed approach.

Supervised learning and pattern recognition is a crucial area of research in information retrieval, knowledge engineering, image processing, medical imaging, and intrusion detection. Numerous algorithms have been designed to address such complex application domains. Despite an enormous array of supervised classifiers, researchers are yet to recognize a robust classification mechanism that accurately and quickly classifies the target dataset, especially in the field of intrusion detection systems (IDSs). Most of the existing literature considers the accuracy and false-positive rate for assessing the performance of classification algorithms. The absence of other performance measures, such as model build time, misclassification rate, and precision, should be considered the main limitation for classifier performance evaluation. This paper’s main contribution is to analyze the current literature status in the field of network intrusion detection, highlighting the number of classifiers used, dataset size, performance outputs, inferences, and research gaps. Therefore, fifty-four state-of-the-art classifiers of various different groups, i.e., Bayes, functions, lazy, rule-based, and decision tree, have been analyzed and explored in detail, considering the sixteen most popular performance measures. This research work aims to recognize a robust classifier, which is suitable for consideration as the base learner, while designing a host-based or network-based intrusion detection system. The NSLKDD, ISCXIDS2012, and CICIDS2017 datasets have been used for training and testing purposes. Furthermore, a widespread decision-making algorithm, referred to as Techniques for Order Preference by Similarity to the Ideal Solution (TOPSIS), allocated ranks to the classifiers based on observed performance reading on the concern datasets. The J48Consolidated provided the highest accuracy of 99.868%, a misclassification rate of 0.1319%, and a Kappa value of 0.998. Therefore, this classifier has been proposed as the ideal classifier for designing IDSs.