Design and Analysis of NIDS Placements to Defend Internal Attacks on a Private Cloud

Network intrusion detection system (NIDS) is indispensable for cloud computing providers to detect ongoing cyber attacks and deter future ones in the cloud computing era. To help cloud users to secure their tenant networks inside a computing cloud, a tenant-based NIDS service model has been proposed where NIDS services are deployed as virtual instances inside tenants. However, this approach imposes significant virtualization overhead at the cost of tenants, and the NIDS provision process can be time-consuming. In this work, we present an innovative service model for OpenStack clouds called Network Intrusion Detection System as a Service (NIDSaaS). NIDSaaS enables on-demand, quick deployment and termination of NIDS, while maintaining lightweight overhead for cloud hosts and tenants. In addition, NIDSaaS provides a straightforward command line interface (CLI) so that cloud administrators can easily integrate NIDS with their tenants. We have implemented a prototype of NIDSaaS and evaluated it on a multi-node OpenStack testbed. Our evaluation results show that NIDSaaS outperforms existing VM-based NIDS service approach substantially in terms of service launch time and resource usage.

Today, networks contribute signi cantly to everyone's life. The enormous usefulness of networks for various services and data storage motivates adversaries to launch attacks on them. Network Intrusion Detection Systems (NIDSs) are used as security measure inside the organizational networks to identify any intrusions and generate alerts for them. The idea of deploying an NIDS is quite known and has been studied and adopted in both academia and industry. However, most of the NIDS literature have emphasized to detect the attacks that originate externally in a wired network infrastructure. In addition, Wi-Fi and wired networks are treated the same for the NIDSs. The open infrastructure in Wi-Fi network makes it different from the wired network. Several internal attacks that could happen in a Wi-Fi network are not pos-sible in a wired network. The NIDSs developed using traditional approaches may fail to identify these internal attacks.The thesis work attempts to develop a Multi-Level Network Intrusion Detection System (ML-NIDS) for Wi-Fi dominant networks that can detect internal attacks speci c to Wi-Fi networks as well as the generic network attacks that are independent of network infrastructure. In Wi-Fi dominant networks, Wi-Fi devices (stations) are prevalent at the edge of campus and enterprise networks and integrated with the fi xed wired infrastructure at the access. The implementation is proposed for Wi-Fi dominant networks; nevertheless, it aims to work for the wired network as well. We develop the ML-NIDS using an ensemble learning method that combines several weaklearners to create a strong learner.

High accurate time synchronization is very important for many applications and industrial environments. In a computer network, synchronization of time for connected devices is provided by the Precision Time Protocol (PTP), which in principal allows for device time synchronization down to microsecond level. However, PTP and network infrastructures are vulnerable to cyber-attacks, which can de-synchronize an entire network, leading to potentially devastating consequences. This paper will focus on the issue of internal attacks on time synchronization networks and discuss how counter-measures based on public key infrastructures, trusted platform modules, network intrusion detection systems and time synchronization supervisors can be adopted to defeat or at least detect such internal attacks.

The Internet of Things (IoT) is an important component of the smart environment, which produces a large volume of data that is considered challenging to handle. In addition, the IoT architecture is vulnerable to many cyberattacks that can target operational devices. Therefore, there is a need for monitoring IoT traffic to analyze, detect malicious activity, and classify cyberattack types. This research proposes a security framework to monitor asymmetrical network traffic in an IoT environment. The framework offers a network intrusion detection system (NIDS) to detect and classify cyberattacks, implemented using a machine learning (ML) model residing in the middleware layer of the IoT architecture. A dimensionality reduction technique known as principal component analysis (PCA) is utilized to facilitate data transmission, which is intended to be sent from the middleware layer to the cloud layer with reduced complexity and fewer unnecessary inputs without compromising the information content. Therefore, the reduced IoT traffic data are sent to the cloud and the PCA data are retransformed to approximate the original data for visualizing the IoT traffic. The NIDS is responsible for reporting the attack type to the cloud in the event of an attack. Our findings indicate that the proposed framework has promising results in classifying the attack type, which achieved a classification accuracy of 98%. In addition, the dimension of the IoT traffic data is reduced by around 50% and it has a similarity of around 90% compared to the original data.

Network intrusion detection systems are considered as one of the basic entities widely utilized and studied in the field of network security that aim to detect any hostile intrusion within a given network. Among many network intrusion detection systems (NIDS), open source systems have gained substantial preference due to their flexibility, support and cost effectiveness. Snort, an open source system is considered as the de-facto standard for NIDS. In this paper, effort has been made to gauge Snort in terms of performance (packet handling) and detection accuracy against TCP Flooding Distributed Denial of Service attack. The evaluation has been done using a sophisticated test-bench under different hardware configurations. This paper has analyzed the major factors affecting the performance and detection capability of Snort and has recommended techniques to make Snort a better intrusion detection system (IDS). Experimental results have shown significant improvement in Snort packet handling capability by using better hardware. However; Snort detection capability is not improved by improving hardware and is dependent upon its internal architecture (signature database and rate filtration). Furthermore, the findings can be applied to other signature based intrusion detection systems for refining their performance and detection capability.

Nowadays, common interest in an information grows rapidly that evolves, many application areas like share market, e- agribusiness and on-demand services. In these applications, delivering information to multiple receivers at the same time makes multicast communication is the next generation dominated data transmission mechanism in mobile ad hoc networks. In spite of efficient bandwidth utilization, multicast is most vulnerable against various types of internal and Byzantine attacks. Existing Intrusion Detection Systems and attacker prevention techniques act too smart to defend these attacking strategies. Accordingly adversaries also update their attacking strategy intelligently to intervene the successful defending schemes. In our work, we present a novel intelligent internal attack on a tree-based multicast routing protocol in MANET. Intelligent adversary launches it's attacking strategy on MAC layer against collision avoidance mechanism only when it can gain more in an attack's success rate. Our simulation study observes the robustness of MAODV against this internal attacking approach. Multicast session's performance metrics such as PDR, throughput and packets drop ratio are analyzed with the presence of adversaries in the multicast group. We also examine the impact of attacker's location in the multicast tree. We design an analytical model that shows the impact of internal attack on multicast group through empirical study. Analytical results compare with NS2 simulation results that prove the validity of analytical models. This empirical study illustrates the importance of designing smarter internal attacker detection mechanism to protect multicast routing protocols from the above-mentioned intelligent internal attacks.

Network Intrusion Detection Systems (NIDSs) are extremely important in defending against emergent cyberattacks. However, current NIDSs for Internet-of-Things (IoT) devices have not taken actual device computation limitation into account, and are still based on resource-consuming neural networks. In this paper, we propose a simple but effective FL-based NIDS. Specifically, we leverage the characteristic of network traffic data (a kind of tabular data), i.e. slight value change does not affect inherent feature, and use data binning to extract feature data on clients. The feature data are then used for training the classifier on the server. We also use data masking to further enhance data protection. We evaluate our NIDS on the public DDoS attack classification benchmark, and the result shows that our NIDS can achieve comparable performance as locally trained NIDS while significantly reducing the communication cost.

Network Intrusion Detection Systems (NIDS) are utilized to find hostile network connections. This can be accomplished by looking at traffic network activity, but it takes a lot of work. The NIDS heavily utilizes approaches for data extraction and machine learning to find anomalies. In terms of feature selection, NIDS is far more effective. This is accurate since anomaly identification uses a number of time-consuming features. Because of this, the feature selection method influences how long it takes to analyze movement patterns and how clear it is. The goal of the study is to provide NIDS with an attribute selection approach. PSO has been used for that purpose. The Network Intrusion Detection System that is being developed will be able to identify any malicious activity in the network or any unusual behavior in the network, allowing the identification of the illegal activities and safeguarding the enormous amounts of confidential data belonging to the customers from being compromised. In the research, datasets were produced utilising both a network infrastructure and a simulation network. Wireshark is used to gather data packets whereas Cisco Packet Tracer is used to build a network in a simulated environment. Additionally, a physical network consisting of six node MCUs connected to a laptop and a mobile hotspot, has been built and communication packets are being recorded using the Wireshark tool. To train several machine learning models, all the datasets that were gathered—created datasets from our own studies as well as some common datasets like NSDL and UNSW acquired from Kaggle—were employed. Additionally, PSO, which is an optimization method, has been used with these ML algorithms for feature selection. In the research, KNN, decision trees, and ANN have all been combined with PSO for a specific case study. And it was found demonstrated the classification methods PSO + ANN outperformed PSO + KNN and PSO + DT in this case study.

Cyber-security experts often require the help of an automated process that filters and classifies network attacks. To apply specific preventive measures for securing networks, the classification of the attack type is the key. Many Machine Learning (ML) models have been proposed as a base for Network Intrusion Detection (NID) systems. However, their performance varies based on multiple factors. For instance, an ML model fitted on a highly imbalanced dataset can be biased toward over-represented attack types. On the other hand, paying attention only to the ML model’s performance in the minority classes can negatively affect its performance in the majority classes. This paper proposes an NID system that addresses the issue of imbalanced datasets and uses Convolutional Neural Networks (CNN) to classify the different attack types. We compare the performance of our proposed system to other systems that use: Random Over-Sampling (ROS), Synthetic Minority Oversampling TEchnique (SMOTE), Adaptive Synthetic Sampling (ADASYN), and Generative Adversarial Networks (GAN). Using the NSL-KDD and the BoT-IoT datasets for benchmarking, we show that our proposed system performs well in the minority classes: recall scores of 70.50% and 72.08% on the User to Root (U2R) and Remote to Local (R2L) attack classes of the NSL-KDD dataset, respectively, while maintaining an overall False Alarm Rate (FAR) of 6.50% and a recall of 90.46% on the binary classification task. Our proposed system scores a weighted average F1-Score of 99.45% on the multi-class classification task using the BoT-IoT dataset.

Network intrusion detection systems are used to help protect and secure network infrastructures. Efficient network intrusion models are required to analyze and assess both present and future network attacks. Various machine learning methods have been developed and evaluated to attempt to efficiently analyze and predict network intrusion attacks to determine network attributes that may contribute to a particular attack type. In this study, we evaluated the UNSW-NB15 data set, represents modern day network attacks and network traffic compared to the previous standard KDD99 data set. Among various machine learning algorithms, extreme gradient boosting (XGBoost) that provides highly efficient and accurate data predictive model were used. We also were able to select a subset of 23 out of 39 usable features using information gain obtained through XGBoost to help distinguish network attack types. Through bivariate analysis, we could compute the percentage of records in a particular value range correspond to an attack type. The final XGBoost model that was developed uses 23 features, may be used for any future network intrusion data where these 23 features are available to easily and efficiently predict network attack types.

Intrusion Detection System (IDS) is a device or software application that monitors and inspects all inbound and outbound network activities, identifies suspicious patterns that may be a network attack from someone attempting to break into or compromise a system. IDS categorize in two ways, namely misuse detection and anomaly detection. In this research, intrusion detection was done by anomaly detection. The data used is KDDCUP dataset 1999, which has 4 types of attacks, namely DoS, U2R, R2L, and Prob. Anomaly detection was built using Backpropagation algorithm optimized by Conjugate Gradient algorithm. In this paper, it was implemented and analyzed the use of CG optimization (Fletcher Reeves, Polak Ribiere, Powell Beale) in the process of backpropagation learning for IDS. Moreover, to minimize the performance of learning rate parameter, four types of line search techniques used, i.e. Brent Search, Golden Section Search, Charalambous Search and Hybrid Bisection-cubic Search. Based on the experiment results, the proposed scheme gives the best accuracy when the data is divided into two classes with a proportion of normal and intrusion data was balanced, with an average accuracy of 93.2%. Meanwhile, the multi class classification model has an average f-measure of 54.13%. The best performance was obtained by using Conjugate Gradient-Fletcher Reeves optimization method and line search method Hybrid Bisection-Cubic Search.

Imagine receiving an email from cybercriminals stating that all your personal information has been compromised— name, date of birth, home address, and finances. They are demanding money from you in exchange for not leaking your sensitive information. It's a terrifying situation to be in, isn't it? We adopt an NIDS-based approach for web application penetration testing in order to resolve this issue. Web application penetration testing is an ongoing security evaluation that mimics actual attacks to evaluate how secure web applications are. The main objective is to find any possible flaws, configuration errors, or vulnerabilities that malicious users can use to jeopardize a web application's availability, confidentiality, or integrity. An NIDS is deployed to detect fraudulent activities at the network level, which can complement conventional penetration testing techniques that concentrate on flaws in the software. The goal of this research is to improve the identification of security vulnerabilities at the network and application levels by combining traditional web application penetration testing with Network Intrusion Detection Systems (NIDS).

Most existing intrusion detection systems use signature-based approach to detect intrusions in audit data streams. This approach has a serious drawback. It cannot protect against novel types of attacks. Thereby there is a growing interest to application of data mining and machine learning methods to intrusion detection. This paper presents a new method for mining outliers designed for application in network intrusion detection systems. This method involves kernel-based fuzzy clustering technique. Network audit records are considered as vectors with numeric and nominal attributes. These vectors are implicitly mapped by means of a special kernel function into a high dimensional feature space, where the possibilistic clustering algorithm is applied to calculate the measure of ”typicalness” and to discover outliers. The performance of the suggested method is evaluated experimentally over KDD CUP 1999 data set.

With the ever increasing need for better cybersecurity, and due to the continuous growth of network traffic bandwidths, there is a continuous pursuit of faster and smarter network intrusion detection systems. Neural network-based solutions on FPGAs are very effective in detecting different types of attacks, but have problems with analyzing network traffic online at line speed. One important bottleneck that limits the throughput in raw traffic-based existing systems, is the input shape of the features that are extracted from the raw data. In this work, we propose new methods for extracting and representing features based on raw network traffic in online network intrusion detection systems. We show that feature dimensionality has a significant influence on the classification accuracy and the throughput. Our experiments are based on FPGA-based neural networks accelerated through FINN. We compare three newly proposed input shapes to the traditional 2D-based approach, and we show that two of the presented techniques greatly surpass the state-of-the-art with regards to accuracy and throughput. Our best architecture reaches a maximum bandwidth of 23.09 Gbps, while maintaining over 99% accuracy on both the UNSW-NB15 and CICIDS2017 datasets.

The subject matter of this article is a HybridAttention mechanism integrated into a deep neural architecture for Network Intrusion Detection Systems (NIDS). This study aims to develop and study a HybridAttention mechanism based on a combination of global (self-attention) and local (dynamic local attention) models to improve the quality of traffic classification in real-time NIDS. The tasks to be solved are as follows: analyzing the applicability of existing attention mechanisms in network intrusion detection; integrating various attention types into a CNN-BiGRU architecture; developing a HybridAttention mechanism based on dynamic window alignment; optimizing the model using Optuna; and experimentally evaluating its performance on benchmark datasets using standard classification metrics. The methods used are: deep learning modeling with CNN-BiGRU architecture, integration of various attention mechanisms, including a novel HybridAttention, hyperparameter optimization using Optuna, and performance evaluation based on standard classification metrics. The results of this study show that the proposed HybridAttention mechanism demonstrates superiority over individual types of attention in all key metrics. The model achieved up to 99.85% accuracy on the NSL-KDD dataset training data and demonstrated strong generalization on the UNSW-NB15 dataset, achieving up to 98.06% accuracy in multi-class classification and up to 99.20% in binary classification. The proposed model also outperformed state-of-the-art approaches for processing unbalanced data and detecting various types of attacks. Conclusions. The scientific novelty of the results obtained is as follows: a HybridAttention mechanism combining self-attention and dynamic local attention was developed to enhance sequential pattern recognition in network traffic; the CNN-BiGRU architecture was improved by integrating multiple attention modules; systematic hyperparameter optimization using Optuna improved generalization on imbalanced data; and the proposed model outperformed existing approaches on benchmark datasets in detecting both known and novel cyberattacks.