Efficient Host-Based Intrusion Detection for IoT Using Lightweight ML Models and Fuzzy Ranking

Chapter 5 - Intrusion Prevention and Detection Systems

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

Intrusion Detection (ID) is essential for protecting contemporary computer networks from a range of threats. Modern ID techniques must cope with increasingly sophisticated attacks as well as rapidly rising network line speeds. Signature based ID is forced to sample sparsely, increasing the likelihood of malicious traffic entering the network without scrutiny. Con sequently, flow-based ID is gaining attention as an effective complement. ID systems are furthermore often characterized as either network-based or host-based. The autonomous multi agent design paradigm is a scalable, attractive alternative for its potential to leverage the strengths of both architectures: the broad perspective and visibility into distributed malicious activity provided by network-based ID, and the comprehensive view of the local node provided by host-based ID. This paper therefore develops an architecture for a new multi agent, flow-based intrusion detection sysem. The architecture is designed in two iterations of increasing complexity. These innovative ID designs use a "repuation" system to permit agents to dynamically find nodes that are most effective for classifying malicious network activity. Furthermore, each system design includes the development of an innovative classifier that uses multi objective evolutionary algorithms to aid in the search for effective operational parameter values. Evaluation using an extensive agent simulation framework highlights the conditions under which the reputation system provides a significant classification benefit.

The accelerated digital transformation of the banking sector has enhanced the delivery of financial services but simultaneously expanded the cyberattack surface, exposing institutions to advanced persistent threat (APT), zero-day exploit, and obfuscated malware. Conventional perimeter defenses, primarily Layer 3 and 4 firewalls and signature-based intrusion detection systems (IDS), offer insufficient protection against encrypted, evasive, and previously unknown cyberattacks, and frequently generate high false-positive rates that burden Security Operations Center (SOC). This study proposes a multilayered adaptive cybersecurity framework that integrates Layer 7 Next Generation Firewall (NGFW), hybrid Network and Host-based Intrusion Detection and Prevention System (NIDPS/HIDPS), and an AI-driven analysis engine. The framework employs a dual-stage detection architecture, combining Convolutional Neural Network (CNN) for spatial representation learning and Random Forest (RF) classifiers for anomaly decisioning. The model was evaluated using a strategically consolidated dataset derived from CIC-IDS-2017 and UNSW-NB15, specifically isolating cyberattack vectors prevalent in financial infrastructures (e.g., SQL Injection, DDoS, and Brute Force). The model achieves 99.65% detection accuracy and a reduced false-positive rate of 0.35%, significantly outperforming classical SVM and standalone signature-based systems. The results demonstrate that the proposed architecture aligned with NIST and PCI-DSS standard as well as defense-in-depth mechanism suitable for real-time, high-frequency financial environments.

In today’s digital era, cyberattacks are becoming increasingly complex, rendering traditional rule-based Intrusion Detection Systems (IDS) often ineffective in recognizing new attack patterns. The primary objective of this study is to design and implement a machine learning model for detecting network intrusions efficiently while minimizing latency, through a comparative analysis of several algorithms: Decision Tree, Random Forest, Support Vector Machine (SVM), and Boosting. The research methodology includes the collection of the NSL-KDD dataset, followed by data transformation, cleaning, normalization, and partitioning into training and testing sets. Each algorithm was trained using tuned parameters, and performance was evaluated using metrics such as accuracy, precision, recall, F1-score, and an analysis of training and prediction time. The results indicate that the Boosting algorithm stands out, achieving an accuracy rate of 99.36%. Boosting also demonstrated greater reliability in detecting minority classes, despite requiring longer training times. The application of machine learning methods—particularly Boosting—proves to be an effective approach to enhancing intrusion detection and can serve as a foundation for developing more adaptive and reliable cybersecurity systems.

As part of the Internet, a NodeMCU becomes a vulnerability to cyber-attack, so the intrusion detection system (IDS) against cyber-attack on the NodeMCU becomes a poignant research challenge. Several studies have applied several machine learning techniques for IDS on NodeMCU; however, there is a research opportunity to improve the performance of existing models. This research aims to increase the IDS performance on NodeMCU with ensemble voting. We hypothesize the realization of how the implementation of an IDS in NodeMCU. Then we obtain and observe a dataset from Kaggle. The dataset comprises five attacks: misconfiguration, DDoS, probe, scanning, and MiTM. Then we design the detection with ensemble voting consisting of a decision tree and a random forest. We benchmark our proposed solution with decision trees and random forest performance. This study uses several test metrics, including , , , and .The test results show that the decision tree has better Precision in predicting misconfiguration attacks and scan attacks than random forests. On the other hand, the random forest has better in predicting normal data, DDoS attacks, probe attacks, and MiTM attacks. In terms of , ensemble voting has the best performance, which is , compared to the decision tree and random forest, which are and , respectively. We conclude that by assembling a decision tree in the random forest with ensemble voting, random forest performance can improve.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

This paper considers blind deconvolution problem that to recover unknown signals fand g from their convolution signal. Non-convex optimization approach is an efficient method to get the solution, but it is a challenge to find the exact solution for a non-convex optimization problem. Existing work provides a full gradient descent (GD) method converging to the global minimum from a proper initialization. However, GD algorithm is not computationally efficient. In this paper, we design the first stochastic gradient descent (SGD) algorithm that converges linearly to the exact solution. We also design a Kaczmarz algorithm which adapts the step size of SGD algorithm. It also has the linear convergence and is more computationally efficient. Finally, we analyze the global geometry of the objective function. Although the function is non-convex, its expectation has a good geometry that every local minimum is also a global optimal point. Our numerical experiments demonstrate that both SGD and Kaczmarz algorithms are more computationally efficient and can converge to the global minimum even without a proper initialization.

Student’s mental health problems have been explored previously in higher education literature in various contexts including empirical work involving quantitative and qualitative methods. Nevertheless, comparatively few research could be found, aiming for computational methods that learn information directly from data without relying on set parameters for a predetermined equation as an analytical method. This study aims to investigate the performance of Machine learning (ML) models used in higher education. ML models considered are Naïve Bayes, Support Vector Machine, K-Nearest Neighbor, Logistic Regression, Stochastic Gradient Descent, Decision Tree, Random Forest, XGBoost (Extreme Gradient Boosting Decision Tree), and NGBoost (Natural) algorithm. Considering the factors of mental health illness among students, we follow three phases of data processing: segmentation, feature extraction, and classification. We evaluate these ML models against classification performance metrics such as accuracy, precision, recall, F1 score, and predicted run time. The empirical analysis includes two contributions: 1. It examines the performance of various ML models on a survey-based educational dataset, inferring a significant classification performance by a tree-based XGBoost algorithm; 2. It explores the feature importance [variables] from the datasets to infer the significant importance of social support, learning environment, and childhood adversities on a student’s mental health illness.

We consider in this work a system of two stochastic differential equations named the perturbed compositional gradient flow. By introducing a separation of fast and slow scales of the two equations, we show that the limit of the slow motion is given by an averaged ordinary differential equation. We then demonstrate that the deviation of the slow motion from the averaged equation, after proper rescaling, converges to a stochastic process with Gaussian inputs. This indicates that the slow motion can be approximated in the weak sense by a standard perturbed gradient flow or the continuous-time stochastic gradient descent algorithm that solves the optimization problem for a composition of two functions. As an application, the perturbed compositional gradient flow corresponds to the diffusion limit of the Stochastic Composite Gradient Descent (SCGD) algorithm for minimizing a composition of two expected-value functions in the optimization literatures. For the strongly convex case, such an analysis implies that the SCGD algorithm has the same convergence time asymptotic as the classical stochastic gradient descent algorithm. Thus it validates, at the level of continuous approximation, the effectiveness of using the SCGD algorithm in the strongly convex case.

Linear prediction methods, such as least squares for regression, logistic regression and support vector machines for classification, have been extensively used in statistics and machine learning. In this paper, we study stochastic gradient descent (SGD) algorithms on regularized forms of linear prediction methods. This class of methods, related to online algorithms such as perceptron, are both efficient and very simple to implement. We obtain numerical rate of convergence for such algorithms, and discuss its implications. Experiments on text data will be provided to demonstrate numerical and statistical consequences of our theoretical findings.

In the paper, we consider a stochastic gradient descent algorithm in combination with a dropout method. We used the theory of intuitionistic fuzzy sets for the assessment of the equivalence of the respective assessment units. We also consider a degree of uncertainty when the information is not enough.

Intrusion detection is an emerging area of research in the computer security and net-works with the growing usage of internet in everyday life. Most intrusion detection systems (IDSs) mostly use a single classifier algorithm to classify the network traffic data as normal behavior or anomalous. However, these single classifier systems fail to provide the best possible attack detection rate with low false alarm rate. In this paper,we propose to use a hybrid intelligent approach using a combination of classifiers in order to make the decision intelligently, so that the overall performance of the resul-tant model is enhanced. The general procedure in this is to follow the supervised or un-supervised data filtering with classifier or cluster first on the whole training dataset and then the output are applied to another classifier to classify the data. In this re- search, we applied Neural Network with Supervised and Unsupervised Learning in order to implement the intrusion detection system. Moreover, in this project, we used the method of Parallelization with real time application of the system processors to detect the systems intrusions.Using this method enhanced the speed of the intrusion detection. In order to train and test the neural network, NSLKDD database was used. Creating some different intrusion detection systems, each of which considered as a single agent, we precisely proceeded with the signature-based intrusion detection of the network.In the proposed design, the attacks have been classified into 4 groups and each group is detected by an Agent equipped with intrusion detection system (IDS).These agents act independently and report the intrusion or non-intrusion in the system; the results achieved by the agents will be studied in the Final Analyst and at last the analyst reports that whether there has been an intrusion in the system or not. Keywords: Intrusion Detection, Multi-layer Perceptron, False Positives, Signature- based intrusion detection, Decision tree, Nave Bayes Classifier

The diagnostic process for Autism Spectrum Disorder (ASD) typically involves time-consuming assessments conducted by specialized physicians. To improve the efficiency of ASD screening, intelligent solutions based on machine learning have been proposed in the literature. However, many existing ML models lack the incorporation of medical tests and demographic features, which could potentially enhance their detection capabilities by considering affected features through traditional feature selection approaches. This study aims to address the aforementioned limitation by utilizing a real dataset containing 45 features and 983 patients. To achieve this goal, a two-phase methodology is employed. The first phase involves data preparation, including handling missing data through model-based imputation, normalizing the dataset using the Min-Max method, and selecting relevant features using traditional feature selection approaches based on affected features. In the second phase, seven ML classification techniques recommended by the literature, including Decision Trees (DT), Random Forest (RF), K-Nearest Neighbors (KNN), Support Vector Machine (SVM), AdaBoost, Gradient Boosting (GB), and Neural Network (NN), are utilized to develop ML models. These models are then trained and tested on the prepared dataset to evaluate their performance in detecting ASD. The performance of the ML models is assessed using various metrics, such as Accuracy, Recall, Precision, F1-score, AUC, Train time, and Test time. These metrics provide insights into the models' overall accuracy, sensitivity, specificity, and the trade-off between true positive and false positive rates. The results of the study highlight the effectiveness of utilizing traditional feature selection approaches based on affected features. Specifically, the GB model outperforms the other models with an accuracy of 87%, Recall of 87%, Precision of 86%, F1-score of 86%, AUC of 95%, Train time of 21.890, and Test time of 0.173. Additionally, a benchmarking analysis against five other studies reveals that the proposed methodology achieves a perfect score across three key areas. By considering affected features through traditional feature selection approaches, the developed ML models demonstrate improved performance and have the potential to enhance ASD screening and diagnosis processes.

Proliferation of connected services in modern vehicles could make them vulnerable to a wide range of cyber-attacks through intra-vehicle networks that connect various vehicle systems. Designers usually equip vehicles with predesigned counter-measures, but these may not be effective against novel cyber-attacks. Intrusion Detection Systems (IDSs) serve as an additional layer of defence when conventional measures that are implemented by the designers fail. Several intrusion detection techniques, such as rule-based IDS, have been proposed in the literature but these techniques have limited capability in detecting novel cyber-attacks. This paper proposes a new Machine Learning (ML)-based IDS for detecting novel cyber-attacks in intra-vehicle networks, specifically in Controller Area Networks (CANs). The proposed IDS generates high-level representations of CAN messages transmitted on the bus exploiting their temporal properties as well as the intra and inter message dependencies through the use of Recurrence Plot (RP), which are then fed into a bespoke Neural Network, designed and trained to detect novel intrusions. Evaluations of the performance of the proposed IDS in comparison with that of the state-of-the-art existing IDS schemes namely Decision Tree (DT), Random Forest (RF) and other well-known approaches demonstrate the superiority of the proposed IDS in this paper.