Enhancing Cybersecurity in Smart Grids through Machine Learning-Based Intrusion Detection Systems

This study proposes a lightweight machine learning-based intrusion detection system (IDS) designed for smart grid environments. The framework integrates feature extraction using autoencoders, dataset balancing with SMOTE, and multiple machine learning and deep learning classifiers to detect cyberattacks efficiently. Experimental results on the UNSW-NB15 dataset demonstrate high detection accuracy and short training time, highlighting the suitability of lightweight IDS models for deployment at resource-constrained edge access points in smart grids.

Intrusion detection systems are used to detect attacks in a network. Machine learning (ML) approaches have been widely used to build such Intrusion Detection Systems (IDSs) because they are more accurate when built from a very large and representative dataset. In recent times, one of the benchmark datasets that are used to build ML-based Intrusion Detection models is CICIDS2017 dataset. The dataset is contained in eight groups and was collected from the Canadian Institute on Cyber Security dataset repository. The dataset is available in both PCAP and netflow formats. This study used the netflow records in the CIDIDS2017 dataset as they are found to contain newer attacks,very large and are found useful for traffic analysis. Exploratory Data Analysis (EDA) techniques were used to reveal various characteristics of the dataset. The general objective is to provide more insights on the nature, structure and issues with the dataset so as to identify the best ways for using it to achieve improved ML-based IDS models. Furthermore, some of the open problems that can arise from the use of the dataset in any machine learning-based Intrusion Detection systems are highlighted and possible solutions are briefly discussed. The EDA techniques used revealed important relationships among input variables and the target class. The study concluded that the EDA can better influence the decision of future IDS researches that use the dataset. Thus, improved machine learning-based intrusion detection systems can be built from the dataset once it is well understood and pre-processed.

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

Investigating the use of moving target defense (MTD) mechanisms in IoT networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite the computational deficiencies many IoT ecosystems typically have. The AI community has extensively studied adversarial threats and attacks on machine learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. Another concept that has gained significant attention in the networking community is Game Theory. Protecting any given network is almost a never-ending battle between the attacker and defender, and hence a natural game of competitors can be modelled based on one’s parametric specifications to gain more insight into how attackers might interact with one’s system. The goal of this thesis is to propose a comprehensive, experimentally verifiable game-theoretic model of MTD in IoT networks to secure the IDS against adversarial attacks. Once a game with state transitions based on given actions can be modelled, reinforcement learning is used to develop policies based on various episodes (rounds) of the game, ultimately optimizing network decisions to minimize successful attacks on machine learning-based IDS. The state-of-the-art ToN-IoT dataset was investigated for MTD feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS was compared to a conventional IDS by analyzing the accuracy curve of the MTD-based IDS and the conventional IDS for varying attacker success rates and resource demands. Our approach has proven effective in securing the IDS against adversarial learning.

There are considerable hurdles that must be overcome in order to maintain adequate security against cyber-attacks in cloud settings because of their dynamic and dispersed nature. A proactive method to identifying and mitigating new threats in real time is provided by adaptive intrusion detection systems (IDS) that make use of machine learning (ML). The design and operation of adaptive intrusion detection systems (IDS) that are adapted for cloud platforms are investigated in this study. Particular attention is paid to the utilisation of supervised, unsupervised, and reinforcement learning methods. It investigates the benefits of adaptive intrusion detection systems (IDS) in terms of identifying abnormal behaviours, minimising the number of false positives, and adapting to shifting threat environments. Several important factors, including the selection of features, the quality of the dataset, and the optimisation of the algorithm, are covered. In addition to this, we investigate the possibility of integrating adaptive intrusion detection systems with cloud-native technologies such as serverless computing and containers. Performance measurements and comparative evaluations demonstrate that machine learning-based intrusion detection systems are more effective than older techniques. Additionally, the study addresses issues such as scalability, data privacy, and adversarial assaults, and it proposes viable methods to improve dependability. The adaptive intrusion detection system (IDS) is an essential component of cloud security methods since it enables continuous monitoring and reaction to complex kinds of attacks.

Cyber security is a big issue in current society since exploiting computer network vulnerabilities has become simple thanks to technological advances and human talents.Currently, several types of assaults are occurring, such as DOS attacks, probing, R2U, R2L viruses, port scanning, buffer overflow, CGI attacks, and floods, among others. A strong foundation is required to build a system for detecting and preventing these threats. The majority of the most recent ways for implementing IDS for computer security are covered in this article. Intrusion Detection Systems are the best answer for cyber-attacks. In a continuously changing environment, machine learning-based intrusion detection systems exhibit excellent accuracy. This study provide a broad overview of machine-learning algorithms, focusing on how they may be used for sophisticated data processing and automation in cybersecurity, with a particular focus on their ability to extract useful insights from cyber data. In addition to, this study investigates a variety of practical applications wherein information knowledge, mechanization, and decision-making might be used to provide proactive, next-generation cyber security. Our paper concludes by emphasizing the potential of computer vision in security in the future and pointing the way toward further research. Ultimately, this study intends to focus on how the status of learning algorithms and related approaches might inform future advancements in the field of cybersecurity.

Adversarial machine learning is a recent area of study that explores both adversarial attack strategy and detection systems of adversarial attacks, which are inputs specially crafted to outwit the classification of detection systems or disrupt the training process of detection systems. In this research, we performed two adversarial attack scenarios, we used a Generative Adversarial Network (GAN) to generate synthetic intrusion traffic to test the influence of these attacks on the accuracy of machine learning-based Intrusion Detection Systems(IDSs). We conducted two experiments on adversarial attacks including poisoning and evasion attacks on two different types of machine learning models: Decision Tree and Logistic Regression. The performance of implemented adversarial attack scenarios was evaluated using the CICIDS2017 dataset. Also, it was based on a comparison of the accuracy of machine learning-based IDS before and after attacks. The results show that the proposed evasion attacks reduced the testing accuracy of both network intrusion detection systems models (NIDS). That illustrates our evasion attack scenario negatively affected the accuracy of machine learning-based network intrusion detection systems, whereas the decision tree model was more affected than logistic regression. Furthermore, our poisoning attack scenario disrupted the training process of machine learning-based NIDS, whereas the logistic regression model was more affected than the decision tree.

Cybersecurity has become a priority concern of the digital society. Many attacks are becoming more sophisticated, requiring strengthening the strategies of identification, analysis, and management of vulnerability to stop threats. Intrusion Detection/Prevention Systems are first security devices to protect systems. This paper presents a survey of several aspects to consider in machine learning-based intrusion detection systems. This survey presents the Intrusion Detection Systems taxonomy, the types of attacks they face, as well as the organizational infrastructure to respond to security incidents. The survey also describes several investigations to detect intrusions using Machine Learning, describing in detail the databases used. Moreover, the most accepted metrics to measure the performance of algorithms are presented. Finally, the challenges are discussed motivating future research.KeywordsIntrusion detection systemsMachine learningCyber security

Optimized machine learning enabled intrusion detection 2 system for internet of medical things

Internet of Things (IoT) security dataset evolution: Challenges and future directions

This dynamism of cyber threats in Industry4.0 and Industry Internet of Things (IIoT) setting makes any static machine learning-based Intrusion Detection Systems (IDS) ineffective in the face of concept drift. As a solution to it, we introduce HYRIDE-RL, a hybrid adaptive IDS, which incorporates Deep Reinforcement Learning (DRL) with an anomaly detector to perform autonomous real time adaptation. Developed as a Markov Decision Process (MDP), a Deep Q-Network (DQN) adaptively modulates the sensitivity of detection based on network statistics and performance feedback. Some of the innovations are a multi-faceted state representation, replay-buffer reset enabling catastrophic forgetting and guided reward shaping to achieve faster recovery. The experiment involving the CICIDS 2017 dataset proves that the difference is not extremely large, but it does exist and the two classes in question are not very different. Model collapse $\mathbf{9 1 . 2} \boldsymbol{\%}$ to $\mathbf{2 . 5} \boldsymbol{\%}$ accuracy, HYRIDE-RL in practice recovers $88.6 \%$ accuracy of 0.917 AUC, reducing recovery. Time by $53 \%$. These results prove its capability in non-stationary and dynamic IIoT.

Intrusion detection systems are mainly prevalent proclivity within our culture today. Interference exposure systems function as countermeasures to identify web-based protection threats. This is a computer or software program that monitors unauthorized network activity and sends alerts to administrators. Intrusion detection systems scan for known threat signatures and anomalies in normal behaviour. This article also analyzed different types of infringement finding systems and modus operandi, focusing on support-vector-machines; Machine-learning; fuzzy-logic; and supervised-learning. For the KDD dataset, we compared different strategies based on their accuracy. Authors pointed out that using support vector machine and machine learning together improves accuracy.

The number of connected IoT devices is increasing significantly due to their many benefits, including automation, improved efficiency and quality of life, and reducing waste. However, these devices have several vulnerabilities that have led to the rapid growth in the number of attacks. Therefore, several machine learning-based intrusion detection system (IDS) tools have been developed to detect intrusions and suspicious activity to and from a host (HIDS—Host IDS) or, in general, within the traffic of a network (NIDS—Network IDS). The proposed work performs a comparative analysis and an ablative study among recent machine learning-based NIDSs to develop a benchmark of the different proposed strategies. The proposed work compares both shallow learning algorithms, such as decision trees, random forests, Naïve Bayes, logistic regression, XGBoost, and support vector machines, and deep learning algorithms, such as DNNs, CNNs, and LSTM, whose approach is relatively new in the literature. Also, the ensembles are tested. The algorithms are evaluated on the KDD-99, NSL-KDD, UNSW-NB15, IoT-23, and UNB-CIC IoT 2023 datasets. The results show that the NIDS tools based on deep learning approaches achieve better performance in detecting network anomalies than shallow learning approaches, and ensembles outperform all the other models.

Intrusion detection systems (IDS) that are powered by machine learning have become an important tool for enhancing online security due to their capacity to detect and respond quickly to potential attacks. This is one of the reasons why IDS have grown so popular. In this article, we investigate how machine learning techniques might be applied to the challenge of intrusion detection by making use of the UNSW-NB15 dataset. The dataset, compiled by researchers at the University of New South Wales, includes benign and malicious network activity examples. The dataset known as UNSW-NB15 is utilised throughout this work in order to conduct an in-depth analysis and comparison of a number of different machine learning strategies. These strategies include decision trees, support vector machines (SVM), random forests, and deep learning models. The data collected from the network traffic is first subjected to preprocessing, after which feature engineering methods are utilised to extract the features of interest. In order to evaluate the usefulness of the constructed models, conventional metrics including as accuracy, precision, recall, and F1 score are utilised. The findings provide evidence that a number of different machine learning algorithms can be used to detect the numerous types of assaults that were represented in the UNSW-NB15 dataset. The study also analyses how different feature engineering strategies affect detection accuracy. Finding the best machine learning algorithms and feature engineering techniques to improve cybersecurity using the UNSW-NB15 dataset is an important outcome of this research that will help to move intrusion detection systems forward. The findings can be used to improve IDS, which helps strengthen the defenses of vital systems and networks against new cyber-attacks.

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.