Enhancing Intrusion Detection System Performance Using a Hybrid of Harris Hawks and Whale Optimization Algorithms

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

Attack-aware Security Function Management

Intrusion detection and prevention systems (IDPS) are security systems that are used to detect and prevent security threats to computer systems and computer networks. These systems are configured to detect and respond to security threats automatically there by reducing the risk to monitored computers and networks. Intrusion detection and prevention systems use different methodologies such as signature based, anomaly based, stateful protocol analysis, and a hybrid system that combines some or all of the other systems to detect and respond to security threats. The growth of systems that use a combination of methods creates some confusion when trying to choose a methodology and system to deploy. This paper seeks to offer a clear explanation of each methodology and then offer a way to compare these methodologies.

Distributed Denial-of-Service (DDoS) attack has been a “nightmare” for cloud. A countermeasure is to establish an Intrusion Detection and Prevention System (IDPS) for cloud. Nevertheless, current IDPSes fail to achieve the detection and prevention in a flexible and lightweight way. In this paper, we propose a novel scheme of IDPS for overcoming the above problem, termed as Auto-scaling IDPS (AsIDPS). AsIDPS is based on Software-Defined Networking (SDN) and Docker container technologies. It first detects abnormal traffic based on the flow statistics collected in SDN switches in real-time. By the SDN controller, the abnormal traffic will be directed to the created Docker containers with Snort running on them for further detection and clean-up. Particularly, the Docker containers can be automatically scaled out or scaled down on demand. The Snort will also deliver an alert to the SDN controller if it detects attack traffic so as to perform a countermeasure if necessary. Benefitting from the flexible network management offered by SDN and the lightweight Docker container, AsIDPS is able to build a flexible and lightweight defense against DDoS attack in cloud. Based on our prototype implementation, we validate the effectiveness of AsIDPS in defending DDoS attack, and also verify its flexibility and lightweight.

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

The accelerated evolution of Industrial Internet of Things (IIoT) 5.0 brings human-centric automation, hyperconnectivity, and Artificial Intelligence (AI) based real-time data analytics. The growth presents cybersecurity challenges with an increased attack surface and advanced threats. Legacy Intrusion Detection and Prevention System (IDPS) are not scalable and lack the agility to deal with these threats. This chapter discusses AI-based IDPS through machine learning, deep learning, and FL to enable real-time threat detection. This chapter also mentions the importance of Explainable AI, blockchain, and edge AI in improving security. The future directions are quantum computing and light AI models, and this provides a roadmap to secure IIoT 5.0 against future cyber-attacks.

Routing protocols are responsible to enable efficient communication in any networking environment. Mobile Ad Hoc Networks are an infrastructure-less, distributed and peer-to-peer networks. Most of the routing protocols designed in this network are based on the consideration that the nodes in the network are supportive and cooperate for multi-hop communication. This consideration is not authentic in the hostile environment. The nodes violate the routing protocol specifications and drop the packets, and known as malicious nodes. However, reputed intermediate nodes also drop the packets whenever they receive the packets more than their handling capabilities, and known as bottleneck intermediate nodes. In order to overcome the situation, various intrusion detection and prevention systems (IDS) are designed. The aim of the IDS is to mitigate the packet dropping nodes from network, but they do not recognize the packet dropping node is either malicious or reputed. The paper aim is to investigate the performance of the existing IDS in the presence of the reputed packet dropping nodes in the network. Performance evaluation is carried out by network simulator, NS-2. The results show that neglecting the reputed packet dropping nodes by IDS algorithms is a serious problem and it negatively impacts on the network performance.KeywordsMANETIntrusion detection systemBottleneck nodeRoutingSimulation

The rapid evolution of next-generation networks (NGNs), driven by 5G, IoT, edge computing, and software-defined networking, has introduced new opportunities alongside complex security challenges. Traditional intrusion detection and prevention systems (IDS), built on signature-based and anomaly-based methods, struggle to cope with the scale, heterogeneity, and dynamic threat landscape of NGNs. In response, artificial intelligence (AI) has emerged as a powerful enabler of modern IDPS. This review surveys AI-powered approaches, beginning with classical machine learning methods such as decision trees, support vector machines, and random forests, and then examining deep learning architectures including convolutional neural networks (CNNs), recurrent neural networks (RNNs), long short-term memory networks (LSTMs), and autoencoders. It further analyses hybrid frameworks that integrate ensemble learning, federated learning, and meta-learning, as well as specialised methods tailored for SDN, IoT, edge, and cloud/5G environments. Benchmark datasets, including NSL-KDD, CICIDS2017, UNSW-NB15, Bot-IoT, IoT-23, and TON_IoT, are reviewed, highlighting their contributions and limitations. The paper identifies key challenges, including dataset scarcity, generalisation gaps, computational overhead, adversarial robustness, explainability, and privacy. Future directions emphasise the need for realistic NGN datasets, lightweight yet accurate architectures, privacy-preserving and federated frameworks, and integrated detection and prevention mechanisms. Overall, AI-powered IDPS demonstrate significant potential to secure NGNs, but realising this vision will require advances that balance accuracy, efficiency, interpretability, and resilience.

The project aims to enhance honeypot security through the integration of blockchain technology into an intrusion detection and prevention system (IDPS). Honeypots are decoy systems deployed to detect, deflect, or study unauthorized use of information systems. By leveraging blockchain, a decentralized and tamper-proof ledger, the project ensures the integrity and immutability of honeypot data, providing robust security against cyber threats.The system employs a blockchain-based architecture where each honeypot event is recorded as a block in the chain, ensuring the integrity of the data. Additionally, smart contracts are utilized to automatically execute predefined actions based on specific conditions detected by the honeypot system, such as blocking IP addresses upon detecting malicious activities. Furthermore, the system facilitates the sharing of threat intelligence among peers in real-time, enhancing collaborative security efforts. Through the integration of blockchain technology, smart contracts, and threat intelligence sharing, the project offers an innovative approach to honeypot security, providing organizations with a more resilient defense against cyber threats.

Although Software-defined networking (SDN) is a promising architecture that simplifies network management and control, it also faces security problems that may affect the whole network. Hence, protecting strategies, such as intrusion detection and prevention system (IDPS), are in need in the SDN context. The potential of machine learning-based solutions can become the motivation of cut-edge deep learning-based intrusion detection system that can leverage the centralized control and view of the controller to secure the underlying infrastructure. However, performing additional IDPS functions in the controller, which needs to process enormous traffic amounts, can overload this component, and slow down the network. This paper introduces an approach of Big Data analysis for intrusion detection system in SDN, named BIDSDN to enhance the classification perfor-mance with a massive amount of network traffic data. Specifically, we leverage Apache Spark to deploy the distributed deep learning – based detector to reduce the processing time on complex algorithms. The experiments conducted on CICIDS2018 dataset with distributed cluster prove the efficacy in tackling the Big Data-related issues in the large-scale network like SDN.

Cybersecurity has become major progress in the digital era. Contraction is an important component of the cyber analysts’ management of information technology, as several government organizations and commercial enterprises are moving to dispersed systems. A cyber security analyst is most importantly responsible for protecting the network against damage. Attacks on networks are becoming more complex and sophisticated every day. The number of connected workplaces leads to heavy traffic, more security attack vectors, security breaches and raises more issues than the cyber area can handle by using human intervention while there is not enough sizable automation. Network Intrusion, thus, becomes the biggest concern of this generation. Intrusion Detection and Prevention System (IDPS) has become a vital complement to almost all organizations' security infrastructure. This chapter includes three network monitoring tools concentrating on the immediate impact and output of cyber assaults on the network. This helps to better comprehend the many directions in the area of network monitoring and cybersecurity research. In general, this chapter aims to study the different network monitoring techniques that can be used in support of various servers and network devices to better understands the effect of cyber-attacks on the network and monitor it through tools such as cacti, weather-map and smokeping. It also sheds light on techniques like artificial intelligence, machine learning, neural networks, fuzzy logic, next-generation firewall and how they can be coupled with Intrusion Detection System (IDS) to detect attacks on private networks.KeywordsIDPSNetwork monitoring toolsCyber-attacks monitoringCybersecurityNext generation firewall

Intrusion detection and prevention systems (IDPSs) are at the core of protecting an enterprise's network. In general, IDPSs use pre-defined rules to detect potential attacks. As the size of an organization grows and new types of intrusions appear, the quantity and complexity of the rules also increase. Moreover, IDPSs generate an overwhelming number of logs that are challenging to handle and analyze. For a more effective and integrative analysis and management of the rules and logs, we propose a novel visual analytics tool, Hyperion. Hyperion interactively visualizes rules to help users understand how the IDPS rules are managed and applied to the enterprise's network entities. Hyperion also provides effective visualizations to enable users to visually analyze the type, period, traffic, and frequency of attacks in addition to a traditional count-based timeline visualization. Finally, Hyperion enables users to interactively simulate the effect of a change in parameters of a detection rule. These features can help streamline the security control cycle consisting of rule application, information collection, log analysis, and rule revision.

The paper presents an analytical model to study the performance and availability of queueing systems with finite queue and two service phases. The first phase has the exponential distribution of service time, while the second one has the hyperexponential distribution. The analytical results obtained are verified using discrete-event simulation. A few numerical examples for varying the service rates and arrival rates are given. The results presented in the paper can be used for analysis of the intrusion detection and prevention systems (IDPS).

Modern cybersecurity relies on Intrusion Detection and Prevention Systems (IDPS) to detect and mitigate malicious network activity. This study proposes eIDPS, a packet-level IDPS leveraging Machine Learning and the extended Berkeley Packet Filter (eBPF) for real-time threat detection within the kernel. Unlike a flow-based approach, which analyzes aggregated network flows, eIDPS operates at the packet level, enabling faster decision-making while it does not drop entire flows when a malicious packet is detected, allowing for more precise threat mitigation. Experimental evaluation using CIC-IDS2017, a benchmark intrusion detection dataset, demonstrates that eIDPS achieves higher precision and F1-score compared to a flow-based solution identified in the literature, while still operating in real time. This comparison highlights the trade-offs between packetlevel and flow-based intrusion detection, offering insights into the deployment of eBPF-based security solutions.

In this paper, a new intrusion detection system (IDS) is presented to deal with distributed denial of service (DDoS) attacks. A combined algorithm based on Harris Hawks Optimization (HHO) and Dragonfly Algorithm (DA) is proposed to select relevant features and eliminate irrelevant and redundant features from the NSL-KDD dataset. The extracted features are presented to a multilayer perceptron (MLP) neural network. This network (as a classifier) divides the network traffic into two classes, normal and attack categories. Performance of the proposed model is evaluated with two standard and widely-used datasets in the field of intrusion detection: NSL-KDD and UNSW-NB15. The results of the simulations clearly show the superiority of the proposed method compared to the previous methods in terms of critical evaluation criteria such as accuracy, precision, recall, and F-Measure. Specifically, the proposed method exhibited improvements of 96.9%, 97.6%, 96%, and 96.8% in these metrics, respectively (compared to the baseline method). The main reason for these improvements is the ability of the combined algorithm to intelligently select the optimal features and reduce the dimensions of the data. This careful selection of features allows the MLP neural network to focus on critical information, increasing the classification accuracy and ultimately improving the performance of the intrusion detection system. This research showed that combining optimization algorithms and machine learning works well. So, it is effective for tackling DDoS attacks. It can lead to better intrusion detection systems. These systems will be more efficient and accurate.