Enhanced Cybersecurity for Network Intrusion Detection System Based Artificial Intelligence (AI) Techniques

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Over the past few years, Internet applications have become more advanced and widely used. This has increased the need for Internet networks to be secured. Intrusion detection systems (IDSs), which employ artificial intelligence (AI) methods, are vital to ensuring network security. As a branch of AI, deep learning (DL) algorithms are now effectively applied in IDSs. Among deep learning neural networks, the convolutional neural network (CNN) is a well-known structure designed to process complex data. The CNN overcomes the typical limitations of conventional machine learning approaches and is mainly used in IDSs. Several CNN-based approaches are employed in IDSs to handle privacy issues and security threats. However, there are no comprehensive surveys of IDS schemes that have utilized CNN to the best of our knowledge. Hence, in this study, our primary focus is on CNN-based IDSs so as to increase our understanding of various uses of the CNN in detecting network intrusions, anomalies, and other types of attacks. This paper innovatively organizes the studied CNN-IDS approaches into multiple categories and describes their primary capabilities and contributions. The main features of these approaches, such as the dataset, architecture, input shape, evaluated metrics, performance, feature extraction, and classifier method, are compared. Because different datasets are used in CNN-IDS research, their experimental results are not comparable. Hence, this study also conducted an empirical experiment to compare different approaches based on standard datasets, and the comparative results are presented in detail.

With the enlarged utilization of computer networks, security has become one of the critical issues. A network intrusion by malicious or unauthorized consumers may cause severe interruption to networks. So, the progress of a strong and dependable network intrusion detection system (IDS) is gradually significant. Intrusion detection relates to a suite of models employed to recognize attacks against network infrastructures and computers. There are dual main intrusion detection models, such as misuse and anomaly detection. Anomaly detection is a central part of intrusion detection in which disruptions of normal behaviour propose the presence of unintentionally or intentionally induced attacks, defects, faults, etc. With the arrival of anomaly-based IDS, many models have progressed in tracking new threats to the systems. Machine learning (ML) and deep learning (DL) models are currently leveraged for anomaly intrusion detection in cybersecurity. This manuscript proposes an Enhanced Anomaly Intrusion Detection using an Optimization Algorithm with Dimensionality Reduction and Hybrid Model (EAID-OADRHM) technique. The proposed EAID-OADRHM technique presents a new approach for perceiving and migrating attacks in cybersecurity. Min–max scaling normalization is primarily employed at the data pre-processing level to clean and transform input data into a consistent range. Furthermore, the proposed EAID-OADRHM technique utilizes the equilibrium optimizer (EO) model for the dimensionality reduction process. Additionally, the classification is performed by employing the long short-term memory and autoencoder (LSTM–AE) model. Finally, the improved Snow Ablation Optimizer (ISAO) model optimally tunes the hyperparameters of the LSTM–AE model, leading to enhanced classification performance. The simulation validation of the EAID-OADRHM approach is examined under the CIC-IDS2017 dataset, and the outcomes are computed using numerous measures. The experimental assessment of the EAID-OADRHM approach portrayed a superior accuracy value of 99.46% over existing methods in the anomaly intrusion detection process.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Cybersecurity has become major progress in the digital era. Contraction is an important component of the cyber analysts’ management of information technology, as several government organizations and commercial enterprises are moving to dispersed systems. A cyber security analyst is most importantly responsible for protecting the network against damage. Attacks on networks are becoming more complex and sophisticated every day. The number of connected workplaces leads to heavy traffic, more security attack vectors, security breaches and raises more issues than the cyber area can handle by using human intervention while there is not enough sizable automation. Network Intrusion, thus, becomes the biggest concern of this generation. Intrusion Detection and Prevention System (IDPS) has become a vital complement to almost all organizations' security infrastructure. This chapter includes three network monitoring tools concentrating on the immediate impact and output of cyber assaults on the network. This helps to better comprehend the many directions in the area of network monitoring and cybersecurity research. In general, this chapter aims to study the different network monitoring techniques that can be used in support of various servers and network devices to better understands the effect of cyber-attacks on the network and monitor it through tools such as cacti, weather-map and smokeping. It also sheds light on techniques like artificial intelligence, machine learning, neural networks, fuzzy logic, next-generation firewall and how they can be coupled with Intrusion Detection System (IDS) to detect attacks on private networks.KeywordsIDPSNetwork monitoring toolsCyber-attacks monitoringCybersecurityNext generation firewall

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

GDLC: A new Graph Deep Learning framework based on centrality measures for intrusion detection in IoT networks

Internet of Medical Things (IoMT) is network of interconnected medical devices (smart watches, pace makers, prosthetics, glucometer, etc.), software applications, and health systems and services. IoMT has successfully addressed many old healthcare problems. But it comes with its drawbacks essentially with patient’s information privacy and security related issues that comes from IoMT architecture. Using obsolete systems can bring security vulnerabilities and draw attacker’s attention emphasizing the need for effective solution to secure and protect the data traffic in IoMT network. Recently, intrusion detection system (IDS) is regarded as an essential security solution for protecting IoMT network. In the past decades, machines learning (ML) algorithms have demonstrated breakthrough results in the field of intrusion detection. Notwithstanding, to our knowledge, there is no work that investigates the power of machines learning algorithms for intrusion detection in IoMT network. This paper aims to fill this gap of knowledge investigating the application of different ML algorithms for intrusion detection in IoMT network. The investigation analysis includes ML algorithms such as K-nearest neighbor, Naïve Bayes, support vector machine, artificial neural network and decision tree. The benchmark dataset, Bot-IoT which is publicly available with comprehensive set of attacks was used to train and test the effectiveness of all ML models considered for investigation. Also, we used comprehensive set of evaluation metrics to compare the power of ML algorithms with regard to their detection accuracy for intrusion in IoMT networks. The outcome of the analysis provides a promising path to identify the best the machine learning approach can be used for building effective IDS that can safeguard IoMT network against malicious activities.

GRU-based deep learning approach for network intrusion alert prediction

Cyberspace is a concept describing a widespread, interconnected digital technology with numerous users. New standards add more concerns with tremendous information gathered from various network sources, which can be utilized for focused cyber-attacks. Digital attacks in networks are getting more complex and subsequently introducing expanding difficulties in precisely distinguishing network intrusions. Inability to forestall the network intrusions could debase the validity of safety administrations, for example, information privacy, trustworthiness, and accessibility. In this work, we center around developing a Network Intrusion Detection System which is implemented utilizing Machine Learning Techniques. IDS dependent on ML techniques are successful and exact in distinguishing varied networks intrusions. Also, many of the ML-based IDS experience the ill effects of an increment in false-positive rate, leading to lower precision and accuracy. Consequently, we present an exploration of the UNSW-NB15 intrusion detection dataset that will be utilized for preparing the machine learning models. In our tests, we carry out various ML approaches namely, Support Vector Machine (SVM), Logistic Regression (LR), Random Forest Classifier (RF), Decision Tree (DT), Gradient boosted decision trees (GBDT). The results demonstrated that the hyperparameter optimization technique using Grid Search and Random Search methods and evaluation using k-fold cross-validation gives better optimization of model parameters and henceforth brings about better execution.KeywordsCross-validationCyberattackDecision tree (DT)Gradient boosted decision trees (GBDT)Hyperparameter TuningLogistic regression (LR)Network intrusion detection system (IDS)Random forest classifier (RF)Support vector machine (SVM)

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

The increasing occurrence of cyberattacks specifically aimed at critical infrastructure has led to the adoption of network intrusion detection techniques for the Internet of Things (IoT). Securing IoT networks is difficult because of the growing number of connected devices and the advanced methods used by attackers. This study investigates the application of machine learning and neural networks in the prevention of prevalent online fraud and assesses their efficacy. The text discusses important ideas related to email filtering, machine learning, artificial neural networks, and network intrusion techniques. The study discusses the difficulties related to e-fraud detection and suggests methods to improve detection systems. Furthermore, it offers a thorough examination of IoT intrusion detection, emphasizing the risks, weaknesses, assaults, and methods of detection. Securing the billions of autonomous nodes in the Internet of Things (IoT), each with distinct characteristics, poses a significant challenge. Conventional techniques like as encryption, access control, and authentication are inadequate when used individually. Thus, this work utilizes deep learning techniques to detect widespread IoT vulnerabilities, such as Distributed Denial of Service (DDoS) assaults. The models are evaluated using different datasets, including NSL-KDD, DS2OS, and IoT Botnet. The evaluation is based on measures such as accuracy, precision, recall, and F1-score. The deep machine learning intrusion detection system has a high accuracy rate of 96.38%, which shows its efficiency in recognizing risks related to the Internet of Things (IoT) Where the data was trained by 80% and the data was tested by 20.

In this paper the software system for network traffic analysis and intrusion detection has been developed. The system for monitoring and analyzing of traffic to detect anomalies and identify attacks based on Hurst parameter has been proposed. This system allows determining the Hurst flow parameter at different intervals of observation. This system can be installed on the network provider to more effectively use the bandwidth by balancing the load between different protocols and subscribers.

Network attacks have become necessary in today’s time due to increased network traffic. To determine whether network traffic is normal or anomalous a supervised machine learning system is developed. A network intrusion detection system (IDS) is a must-have piece of a security system. This proposed study aims to discover new patterns automatically from substantial quantities of network data, reducing time manually compiling intrusion and normal behavior patterns. The best model in terms of detection success rate was discovered using a supervised learning algorithm and feature selection method. AdaBoost outperforms Neural Network, kNN, and Naive Bayes in supervised machine learning with feature selection in this study, with a detection accuracy of 100.00%, 99.30%, 91.60%, and 99.70%, respectively. The Network Intrusion Detection dataset is used to classify network intrusions to evaluate the study and it has also been used in past studies. On the other hand, the proposed model proved to be more effective than other studies in terms of intrusion detection. The proposed approach can be used in various fields, including finance, health, and transportation. Furthermore, additional parameter tuning could be added, and different feature selection techniques could be used to improve the performance of the classifiers.