Development of a Network Intrusion Detection Model using Hybridised Machine Learning Algorithms

Cyberspace is a concept describing a widespread, interconnected digital technology with numerous users. New standards add more concerns with tremendous information gathered from various network sources, which can be utilized for focused cyber-attacks. Digital attacks in networks are getting more complex and subsequently introducing expanding difficulties in precisely distinguishing network intrusions. Inability to forestall the network intrusions could debase the validity of safety administrations, for example, information privacy, trustworthiness, and accessibility. In this work, we center around developing a Network Intrusion Detection System which is implemented utilizing Machine Learning Techniques. IDS dependent on ML techniques are successful and exact in distinguishing varied networks intrusions. Also, many of the ML-based IDS experience the ill effects of an increment in false-positive rate, leading to lower precision and accuracy. Consequently, we present an exploration of the UNSW-NB15 intrusion detection dataset that will be utilized for preparing the machine learning models. In our tests, we carry out various ML approaches namely, Support Vector Machine (SVM), Logistic Regression (LR), Random Forest Classifier (RF), Decision Tree (DT), Gradient boosted decision trees (GBDT). The results demonstrated that the hyperparameter optimization technique using Grid Search and Random Search methods and evaluation using k-fold cross-validation gives better optimization of model parameters and henceforth brings about better execution.KeywordsCross-validationCyberattackDecision tree (DT)Gradient boosted decision trees (GBDT)Hyperparameter TuningLogistic regression (LR)Network intrusion detection system (IDS)Random forest classifier (RF)Support vector machine (SVM)

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

In this paper the software system for network traffic analysis and intrusion detection has been developed. The system for monitoring and analyzing of traffic to detect anomalies and identify attacks based on Hurst parameter has been proposed. This system allows determining the Hurst flow parameter at different intervals of observation. This system can be installed on the network provider to more effectively use the bandwidth by balancing the load between different protocols and subscribers.

Nowadays, one critical challenge of cybersecurity administrators is the protection of online resources from network intrusions. Despite several academic and industry research initiatives, full protection of online resources from these network intrusions is not feasible. Therefore, several techniques have been developed that use network audit data for accurate detection of network intrusions effectively and efficiently and are used in network intrusion detection systems (NIDSs). But, most of NIDSs reported low detection accuracy with high false alarm rate and provide a single solution that lacks in classification trade-offs. In this paper, the authors present a hybrid approach of multi-objective genetic algorithm and neural networks for creating a set of ensemble solutions for detecting network intrusions effectively. The proposed approach works in two phases that initially creates a set of non-dominating solutions or Pareto optimal solutions of base techniques and then creates ensemble solutions. In the outcome of individual solutions or models in the ensemble are aggregated using most popular method of majority voting. The proposed hybrid approach is evaluated using benchmark datasets of NSL_KDD and ISCX-2012 datasets for intrusion detection. The evaluation results using benchmark datasets demonstrate that the proposed hybrid approach enables detecting network intrusions effectively as compared to conventional ensemble approaches, namely bagging and boosting. The resultant ensemble solutions are non-dominating and provide classification trade-offs for cybersecurity administrators. The results also show that the proposed hybrid approach detects both minority and majority intrusion types accurately. The proposed hybrid approach demonstrated a detection accuracy of 97% and 88% with FPR of 2.4% and 2% for ISCX-2012 and NSL_KDD datasets, respectively.

The Internet of Medical Things (IoMTs) is a network of connected medical equipment such as pacemakers, prosthetics, and smartwatches. Utilizing the IoMT-based system, a huge amount of data is generated, offering experts a valuable resource for tasks such as prediction, real-time monitoring, and diagnosis. To do so, the patient's health data must be transferred to database storage for processing because of the limitations of the storage and computation capabilities of IoMT devices. Consequently, concerns regarding security and privacy can arise due to the limited control over the transmitted information and reliance on wireless transmission, which leaves the network vulnerable to several kinds of attacks. Motivated by this, in this study, we aim to build and improve an efficient intrusion detection system (IDS) for IoMT networks. The proposed IDS leverages tree-based machine learning classifiers combined with filter-based feature selection techniques to enhance detection accuracy and efficiency. The proposed model is used for monitoring and identifying unauthorized or malicious activities within medical devices and networks. To optimize performance and minimize computation costs, we utilize Mutual Information (MI) and XGBoost as filter-based feature selection methods. Then, to reduce the number of the chosen features selected, we apply a mathematical set (intersection) to extract the common features. The proposed method can detect intruders while data are being transferred, allowing for the accurate and efficient analysis of healthcare data at the network's edge. The system's performance is assessed using the CICIDS2017 dataset. We evaluate the proposed model in terms of accuracy, F1 score, recall, precision, true positive rate, and false positive rate. The proposed model achieves 98.79% accuracy and a low false alarm rate 0.007 FAR on the CICIDS2017 dataset according to the experimental results. While this study focuses on binary classification for intrusion detection, we are planning to build a multi-classification approach for future work which will be able to not only detect the attacks but also categorize them. Additionally, we will consider using our proposed feature selection technique for different ML classifiers and evaluate the model's performance empirically in real-world IoMT scenarios.

With the enlarged utilization of computer networks, security has become one of the critical issues. A network intrusion by malicious or unauthorized consumers may cause severe interruption to networks. So, the progress of a strong and dependable network intrusion detection system (IDS) is gradually significant. Intrusion detection relates to a suite of models employed to recognize attacks against network infrastructures and computers. There are dual main intrusion detection models, such as misuse and anomaly detection. Anomaly detection is a central part of intrusion detection in which disruptions of normal behaviour propose the presence of unintentionally or intentionally induced attacks, defects, faults, etc. With the arrival of anomaly-based IDS, many models have progressed in tracking new threats to the systems. Machine learning (ML) and deep learning (DL) models are currently leveraged for anomaly intrusion detection in cybersecurity. This manuscript proposes an Enhanced Anomaly Intrusion Detection using an Optimization Algorithm with Dimensionality Reduction and Hybrid Model (EAID-OADRHM) technique. The proposed EAID-OADRHM technique presents a new approach for perceiving and migrating attacks in cybersecurity. Min–max scaling normalization is primarily employed at the data pre-processing level to clean and transform input data into a consistent range. Furthermore, the proposed EAID-OADRHM technique utilizes the equilibrium optimizer (EO) model for the dimensionality reduction process. Additionally, the classification is performed by employing the long short-term memory and autoencoder (LSTM–AE) model. Finally, the improved Snow Ablation Optimizer (ISAO) model optimally tunes the hyperparameters of the LSTM–AE model, leading to enhanced classification performance. The simulation validation of the EAID-OADRHM approach is examined under the CIC-IDS2017 dataset, and the outcomes are computed using numerous measures. The experimental assessment of the EAID-OADRHM approach portrayed a superior accuracy value of 99.46% over existing methods in the anomaly intrusion detection process.

This paper describes the ESIDE-Depian intrusion detection and prevention system, which uses Bayesian structural and parametric learning and also evidence propagation and adaptation, in order to improve the accuracy and manageability of network intrusion detection systems (NIDS). Current NIDS do not consider the two main detection paradigms, i.e. misuse detection and anomaly detection, in an unified style, so the analysis is not inherently complete. Besides, historical data are not generally used, neither for analysis nor for sequential adaptation of the knowledge representation models used for detection; hence this wealthy information about the essence and the potential trends of the target system is not commonly considered. Thus, by the generalized use of Bayesian belief networks, ESIDE-Depian achieves the main goal of detecting and preventing both well-known and also zero-day attacks with excellent results, by means of unified real-time analysis of network traffic.

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

The accelerated digital transformation of the banking sector has enhanced the delivery of financial services but simultaneously expanded the cyberattack surface, exposing institutions to advanced persistent threat (APT), zero-day exploit, and obfuscated malware. Conventional perimeter defenses, primarily Layer 3 and 4 firewalls and signature-based intrusion detection systems (IDS), offer insufficient protection against encrypted, evasive, and previously unknown cyberattacks, and frequently generate high false-positive rates that burden Security Operations Center (SOC). This study proposes a multilayered adaptive cybersecurity framework that integrates Layer 7 Next Generation Firewall (NGFW), hybrid Network and Host-based Intrusion Detection and Prevention System (NIDPS/HIDPS), and an AI-driven analysis engine. The framework employs a dual-stage detection architecture, combining Convolutional Neural Network (CNN) for spatial representation learning and Random Forest (RF) classifiers for anomaly decisioning. The model was evaluated using a strategically consolidated dataset derived from CIC-IDS-2017 and UNSW-NB15, specifically isolating cyberattack vectors prevalent in financial infrastructures (e.g., SQL Injection, DDoS, and Brute Force). The model achieves 99.65% detection accuracy and a reduced false-positive rate of 0.35%, significantly outperforming classical SVM and standalone signature-based systems. The results demonstrate that the proposed architecture aligned with NIST and PCI-DSS standard as well as defense-in-depth mechanism suitable for real-time, high-frequency financial environments.

Today by growing network systems, security is a key feature of each network infrastructure. Network Intrusion Detection Systems (IDS) provide defense model for all security threats which are harmful to any network. The IDS could detect and block attack-related network traffic. The network control is a complex model. Implementation of an IDS could make delay in the network. Several software-based network intrusion detection systems are developed. However, the model has a problem with high speed traffic. This paper reviews of many type of software architecture in intrusion detection systems and describes the design and implementation of a high-performance network intrusion detection system that combines the use of software-based network intrusion detection sensors and a network processor board. The network processor which is a hardware-based model could acts as a customized load balancing splitter. This model cooperates with a set of modified content-based network intrusion detection sensors rather than IDS in processing network traffic and controls the high-speed.

Network Intrusion Detection System (NIDS) has become more important as a large number of diverse devices connect to the Internet of Things (IoT). Generally, training an effective NIDS requires a large amount of high-quality and centralized attack data. However, in real-world scenarios, it is difficult to centralize the distributed data for training NIDS in the IoT due to the privacy concerns and data format heterogeneity. To solve this problem, a novel NIDS combining federated learning and cost-sensitive learning is proposed, named FIDS-CL. Specifically, federated learning with dynamic weights aggregation tackles the problem of non-clusterable data, where multiple clients collaboratively enhance the overall performance while dynamically aggregating weights to maximize the retention of high-performing client models. Moreover, cost-sensitive learning is employed to alleviate the problem of class imbalance in NIDS by dynamically adjusting the gradient descent weights of different classes in the loss function, thereby emphasizing the importance of minority classes. Therefore, our method can effectively handle data imbalance while safeguarding data privacy of clients, which is more effective to detect network intrusions. The experiments conducted across various scenarios validate the superior detection capabilities and computational efficiency of FIDS-CL when compared to other state-of-the-art NIDSs.

Intrusion detection is a significant technique for detecting various attacks in Wireless Mesh Networks (WMNs). Intrusion Detection Systems (IDS) powered by machine learning algorithms play a vital role in enhancing security by actively monitoring data traffic in real-time. The performance of attack detection in IDS is reduced by the existence of noisy and unwanted features in the network data. Hence, extracting Informative Features (IF) is essential for enhancing the effectiveness of the IDS. The proposed approach optimally selects IF from the network dataset, which facilitates in accurately detecting intrusions. Existing methods lack in efficient feature selection, leading to higher computational complexity and lower detection performance. This research aims to enhance IDS accuracy by leveraging the eXtreme Gradient Boosting (XGBoost) algorithm to classify the intrusions in the mesh network of smart grid and the optimal feature selection carried out with the help of Golden Eagle Optimization Algorithm (GEOA). This novel hybrid IDS model enhances the attack detection in WMNs. The proposed IDS’s performance is improved by using a feature selection method based on the GEOA, and then obtained results are compared against evolutionary algorithms-based features selection method. The proposed model of IDS using XGBoost algorithm is tested on a smart grid dataset, and its performance is compared with existing literature works.

Over the years, the vulnerability of the network system has completely revolutionized the security system. Attackers simply exploit these exposures to gain undue access to network resources. It is essential to safeguard network resources with the Intrusion Prevention System (IPS) and Intrusion Detection System (IDS). Hence, to develop an optimized IDS model using ensemble modeling of machine learning technique is paramount. Therefore, this research attempts to build a network IDS using an ensemble of Decision Trees (DT) algorithms to optimize an IDS model. Furthermore, the C4.5 DT classifier used on the University of New South Wales Network-Based 2015 (UNSW-NB15) network data set. Then the ensemble techniques of bagging and AdaBoost are compared during the performance evaluation. The results of this work depict that performance increase as training size increases. Consequently, the results showed that adopting the ensemble model for the C4.5 decision tree classified improved network intrusion classification compared to using the machine learning algorithm in isolation. Moreover, the result also showed an improved classification model for network IDS model. The AdaBoost ensemble model of the C4.5 DT algorithm using partitions of 90% of training and 10% of testing data sets performs the best with 98% accuracy and precision.

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey