Effect of Mutation and Crossover Probabilities on Genetic Algorithm and Signature Based Intrusion Detection System

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The subject of Computer Network Intrusion Detection System (IDS) is a very interesting research topic actively pursued by many investigators. The goal of intrusion detection is to monitor network assets and to detect anomalous behaviour and misuse. This concept has been around for the past several years but only recently, it has seen a dramatic rise in interest of researchers and system developers for incorporation into the overall information security infrastructure. In today's world, the concept of information has been moved to the digital size from conventional size. Protection of the data stored in the digital archive and is easily accessibility at any time have become a quite important phenomenon. In this concept, intrusion detection and prevention systems as security tools are widely used today [1]. In this paper, a signature based intrusion detection system approach has been proposed for computer network security. This paper is based on the efficient working of the Signature based intrusion detection method and protects the computer network against the intrusion or the unspecified packets.

In the context of a computer system, computer security is the prevention of an illicit action against the system. For this purpose, computer security must determine the difference between normal and harmful activities. These activities can come from outside or from inside the system to be protected. In a similar manner, the role of the Human Immune System (HIS) is to detect and defend against harm. This similarity has inspired approaches in the area of computer security, including the use of immune-based approaches to build Intrusion Detection and Response Systems (IDRSs). As a concrete example, this chapter introduces a new approach for Intrusion Detection (ID) and Intrusion Response (IR) to build a completely distributed and decentralised IDRS for use in computer networks. This approach is called Intrusion Detection and Response extended with Agent Mobility, or IDReAM for short. IDReAM combines Mobile Agents (MAs) with two self-organising paradigms inspired by natural life systems. The Intrusion Detection System (IDS) is inspired by the metaphor of the immune system that protects the human body from external threats. Specialised cells of the immune system, called the T cells, travel around the body to detect possible threats by eliminating the proteins that they do not recognise as safe proteins—referred to as non-self proteins. Intrusion Detection Agents (IDAs) roam the network to detect suspicious behaviours in a manner that mimics the behaviour of T cells. The Intrusion Response System (IRS) also borrows mechanisms from the stigmergic paradigm of a colony of ants. At the time of foraging, the ants use the environment to diffuse a chemical substance called the pheromone which traces the route for the other ants from the nest to the source of food. Intrusion Response Agents (IRAs) roam the network to respond to the IDAs’ alerts, mimicking the behaviour of the ants to trace the route to the alert and give the response. The two natural systems exhibit a social behaviour by the organisation of their entities, T cells and ants, which is not possible without the functionality of mobility.KeywordsIntrusion DetectionAgent MobilityIntrusion Detection SystemComputer SecurityHuman Immune SystemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Over the last few years, a plethora of papers presenting machine-learning-based approaches for intrusion detection have been published. However, the majority of those papers do not compare their results with a proper baseline of a signature-based intrusion detection system, thus violating good machine learning practices. In order to evaluate the pros and cons of the machine-learning-based approach, we replicated a research study that uses a deep neural network model for intrusion detection. The results of our replicated research study expose several systematic problems with the used datasets and evaluation methods. In our experiments, a signature-based intrusion detection system with a minimal setup was able to outperform the tested model even under small traffic changes. Testing the replicated neural network on a new dataset recorded in the same environment with the same attacks using the same tools showed that the accuracy of the neural network dropped to 54%. Furthermore, the often-claimed advantage of being able to detect zero-day attacks could not be seen in our experiments.

Chapter 5 - Intrusion Prevention and Detection Systems

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Processing huge amounts of network data is one of the largest challenges for network-based intrusion detection system (IDS). Usually these data contain lots of irrelevant or redundant features. To improve the efficiency of IDS, relevant features are necessary to be extracted from original data via feature selection approaches. In this paper, an effective feature selection approach based on Bayesian Network classifier is proposed. And with the same intrusion detection benchmark dataset (NSL-KDD), the performance of the proposed approach is evaluated and compared with other commonly used feature selection methods. It is shown by empirical results that features selected by our approach have decreased the time to detect attacks and increased the classification accuracy as well as the true positive rates significantly.

Given the exponential growth of Internet and increased availability of bandwidth, Intrusion Detection has become the critical component of Information Security and the importance of secure networks has tremendously increased. Though the concept of Intrusion Detection was introduced by James Anderson J. P. in the year 1980, it has gained lots of importance in the recent years because of the recent attacks on the IT infrastructure. The main objective of this study is to examine the existing literature on various approaches for Intrusion Detection in particular Anomaly Detection, to examine their conceptual foundations, to taxonomize the Intrusion Detection System (IDS) and to develop a morphological framework for IDS for easy understanding. In this study a detailed survey of IDS from the initial days, the development of IDS, architectures, components are presented.

With the rapid expansion of digital networks and the increasing complexity of cyber threats, network security has emerged as a crucial field within information and communications technology (ICT). Modern organizations face growing risks from sophisticated cyber-attacks that threaten the confidentiality, integrity, and availability of critical systems. Intrusion Detection Systems (IDS) have become a foundational tool for identifying and mitigating unauthorized access and suspicious activities within networks. These systems are broadly categorized into Signature-Based Intrusion Detection Systems (SIDS), which rely on known threat patterns, and Anomaly-Based Intrusion Detection Systems (AIDS), which detect deviations from normal behavior to identify unknown attacks. Despite their strengths, both types face significant limitations, including high false-positive rates and challenges in real-time detection. This study explores the evolving landscape of network security threats and critically analyzes existing intrusion detection techniques. It highlights the integration of alert correlation and prediction mechanisms that enhance early detection and response capabilities. Furthermore, the study addresses key limitations and challenges in IDS implementation and identifies emerging trends aimed at improving scalability, intelligence, and adaptability of detection mechanisms. By evaluating current systems and proposing directions for future research, this work contributes to the development of more robust and proactive network defense strategies in an increasingly interconnected digital world.

An intrusion detection system (IDS) attempts to identify attacks by comparing collected data to predefined signatures known to be malicious (signature-based IDS) or to a model of legal behaviour (anomaly-based IDS). Anomaly-based approaches have the advantage of being able to detect previously unknown attacks, but they suffer from the difficulty of building robust models of acceptable behaviour which may result in a large number of false alarms. Two reasons for the large number of false alarms, caused by incorrect classification of events in current systems, one is the simplistic aggregation of model outputs inthe decision phase. The other reason is the lack of integration of additional information into the decision process. To mitigate these shortcomings, this paper proposes a two stratum Bayesian networks based anomaly detection and decision model for intrusion detection system. Bayesian networks improve the aggregation of outputs, such as empirical data and allow one to seamlessly incorporate additional information. Experimental results clearly demonstrate the efficiency of our approach to improve the accuracy of the intrusion detection and decision process in an anomaly based IDS.

The growing sophistication of cyberattacks is making it harder to detect breaches accurately. Failure to prevent intrusions can damage the reputation of the security services. A. Data accessibility, confidentiality, integrity. To address computer security risks in wireless sensor networks (WSN), a range of intrusion detection approaches have been presented in the literature, which can be classified into two general categories: anomaly-based intrusion detection systems (AIDS) and signature-based intrusion detection systems (SIDS). This survey study presents an overview of the datasets commonly used for evaluation, the taxonomy of existing IDS, and a detailed review of significant recent research. The evasion strategies used by attackers to avoid detection in WSN are also described, along with the challenges that need to be addressed in future research to oppose these strategies and improve the security of computer systems.

Internet attacks have become more sophisticated over time, and they can now circumvent basic security measures like antivirus scanners and firewalls. Identifying, detecting, and avoiding breaches is essential for network security in today's computing world. Adding an extra layer of defence to the network infrastructure through an Intrusion Detection System is one approach to improve network security. Anomaly-based or signature-based detection algorithms are used by existing Intrusion Detection Systems (IDS). Signature-based IDS, for example, detects attacks based on a set of signatures but is unable to detect zero day attacks. In contrast, anomaly-based IDS analyses deviations in behaviour and can detect unexpected attacks. This study suggests designing and developing an Advanced signature-based Intrusion Detection System for Improved Performance by Combining Signature and Anomaly-Based Approaches. It includes three essential stages, first Signature-based IDS used for checking the attacks from the Signature Ruleset using Decision Tree received accuracy 96.96%, and the second stage Anomaly-based IDS system used Deep learning technique ResNet50. The model relies on ResNet50, a Convolutional Neural Network with 50 layers that received an accuracy of 97.25%. By classifying all network packets into regular and attack categories, the combination of both detect known and unknown attacks is the third stage and generates signature from anomaly-based IDS. It gives the accuracy of 98.98% for detection of intrusion. Here findings show that the suggested intrusion detection system may efficiently detect real-world intrusions.KeywordsNetwork securityIntrusion detection systemMachine learningDecision tree

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The query cost usually as an important criterion for a distributed database. The genetic algorithm is an adaptive probabilistic search algorithm, but the crossover and mutation probability usually keep a probability in traditional genetic algorithm. If the crossover probability keep a large value, the possibility of damage for genetic algorithm model is greater; In turn, if the crossover probability keep a small value, the search process will transform a slow processing or even stagnating. If the mutation probability keep a small value, a new individual can be reproduced difficultly; In turn, if the mutation probability keep a large value, the genetic algorithm will as a Pure random search algorithm. To solve this problem, proposed a improved genetic algorithm that multiple possibility of crossover and mutation based on k-means clustering algorithm. The experiment results indicate that the algorithm is effective.

Intrusion detection has become a critical component of network administration due to the vast number of attacks persistently threaten our computers. Traditional intrusion detection systems are limited and do not provide a complete solution for the problem. They search for potential malicious activities on network traffics; they sometimes succeed to find true security attacks and anomalies. However, in many cases, they fail to detect malicious behaviours (false negative) or they fire alarms when nothing wrong in the network (false positive). In addition, they require exhaustive manual processing and human expert interference. Applying Data Mining (DM) techniques on network traffic data is a promising solution that helps develop better intrusion detection systems. Moreover, Network Behaviour Analysis (NBA) is also an effective approach for intrusion detection. In this paper, we discuss DM and NBA approaches for network intrusion detection and suggest that a combination of both approaches has the potential to detect intrusions in networks more effectively.