Enhancing Intrusion Detection Systems with Recurrent Neural Networks in D23 Deep Learning

Chapter 5 - Intrusion Prevention and Detection Systems

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

Intrusion Detection Systems (IDS) is one of the important aspects of cyber security that can detect the anomalies in the network traffic. IDS are a part of Second defense line of a system that can be deployed along with other security measures such as access control, authentication mechanisms and encryption techniques to secure the systems against cyber-attacks. However, IDS suffers from the problem of handling large volume of data and in detecting zero-day attacks (new types of attacks) in a real-time traffic environment. To overcome this problem, an intelligent Deep Learning approach for Intrusion Detection is proposed based on Convolutional Neural Network (CNN-IDS). Initially, the model is trained and tested under a new real-time traffic dataset, CSE-CIC-IDS 2018 dataset. Then, the performance of CNN-IDS model is studied based on three important performance metrics namely, accuracy / training time, detection rate and false alarm rate. Finally, the experimental results are compared with those of various Deep Discriminative models including Recurrent Neural network (RNN), Deep Neural Network (DNN) etc., proposed for IDS under the same dataset. The Comparative results show that the proposed CNN-IDS model is very much suitable for modelling a classification model both in terms of binary and multi-class classification with higher detection rate, accuracy, and lower false alarm rate. The CNN-IDS model improves the accuracy of intrusion detection and provides a new research method for intrusion detection.

A rapid increase in the instances of cyberattacks has been observed with the expanding digitization. This leads to an urgent and critical need for developing robust intrusion detection systems (IDS) which can identify the occurrences of malicious activities within the network traffic. The present work proposes a novel, explainable, multilayer, lightweight adaptive IDS based on a Recurrent Neural Network (RNN). The purpose of this proposed IDS is to improve threat detection capabilities, especially low frequency high severe attack. The performance of the proposed IDS is evaluated using the UNR-IDD dataset. The network traffic is classified into normal and attack categories to assess the effectiveness of the proposed IDS. Two separate IDS models are developed. Model A is used to detect attacks on the basis of the frequency of the attacks, and Model B detects threats based on the severity of the attacks. Through the layered approach, the overall detection accuracy of 95.7% is achieved in Model A, and 97.5% is obtained in Model B. The present work highlights that the proposed IDS shows a remarkable improvement in the detection of less frequent severe attacks in comparison to existing IDS. The comparative result analysis of RNN-based IDS with Machine Learning models such as LR, Naïve Bayes, Cat Boost, Random Forest and Multilayer Perceptron models shows RNN-based IDS has outperformed the Machine Learning models. Explainable AI (XAI), the SHAP method is used for better interpretation of the proposed decisions. XAI helps to identify the network traffic that can influence predictions and detect potential biases. It also helps researchers and practitioners to validate model behaviour and establish trust in the system’s outputs.

In this paper, by combining the known deep learning related literature in the field of intrusion detection, and the existing in the design of intrusion detection system based on the deep learning common low detection efficiency and high rate of false positives, as well as the training data set used by the problems of unbalanced data, etc., through the depth study of feature extraction and data processing ability. To study the intrusion detection method of the Internet of Things based on deep learning. The work and achievements are as follows:First of all, will be used for feature selection embedded model (EM) and used in intrusion detection of the convolution neural network (CNN), combined with lightweight intrusion detection model (XCNN), because it is an embedded model (EM), so can reduce the impact on the equipment, at the same time compared with other algorithms, the computing time is shorter, the same or even better.Second, proposed to the Attention mechanism (Self - Attention) is applied to intrusion detection system, due to the nature of the Attention mechanism, the mechanism and long Attention can greatly reduce the training time, through introducing the residual network, application feature coding technique again the sparse features thickened into low density at high altitudes, and join to its relative position encoding, So it can sense global information and solve the long-term dependence problem of recurrent neural network.Finally, the results of the intrusion detection method were analyzed on the Pthon simulation platform, and the relevant indicators were verified by using THE NSL-KDD dataset, THE CIC-IDS2017 dataset and the CSE-CIC-IDS2018 dataset. The effectiveness of the method was proved by building a laboratory Internet of Things environment for actual testing. The experimental results show that the algorithm can greatly reduce training time, improve training efficiency, and have the same or even better performance results.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Cloud computing (CC) is an internet-enabled environment that provides computing services such as networking, databases, and servers to clients and organizations in a cost-effective manner. Despite the benefits rendered by CC, its security remains a prominent concern to overcome. An intrusion detection system (IDS) is generally used to detect both normal and anomalous behavior in networks. The design of IDS using a machine learning (ML) technique comprises a series of methods that can learn patterns from data and forecast the outcomes consequently. In this background, the current study designs a novel multi-objective seagull optimization algorithm with a deep learning-enabled vulnerability detection (MOSOA-DLVD) technique to secure the cloud platform. The MOSOA-DLVD technique uses the feature selection (FS) method and hyperparameter tuning strategy to identify the presence of vulnerabilities or attacks in the cloud infrastructure. Primarily, the FS method is implemented using the MOSOA technique. Furthermore, the MOSOA-DLVD technique uses a deep belief network (DBN) method for intrusion detection and its classification. In order to improve the detection outcomes of the DBN algorithm, the sooty tern optimization algorithm (STOA) is applied for the hyperparameter tuning process. The performance of the proposed MOSOA-DLVD system was validated with extensive simulations upon a benchmark IDS dataset. The improved intrusion detection results of the MOSOA-DLVD approach with a maximum accuracy of 99.34% establish the proficiency of the model compared with recent methods.

With the continuous development of computer networks, the security of the network has become increasingly prominent. A major threat to network security is the intrusion of information systems through the network. Intrusion detection of the traditional intrusion detection and alarm technology is not sufficient. Based on neural network technology, this paper studies the intrusion detection and alarm correlation technology. Based on the research on the working principle and workflow of the existing intrusion detection system, a new neural network-based intrusion detection and alarm method is proposed. A neural network-based intrusion detection and alarm system is designed and implemented. Through the experiment of the system prototype, the results show that the intrusion detection and alarm system based on the neural network has a higher detection rate and a lower false alarm rate for intrusion behaviors such as denial of service attack and has higher detection ability for unknown attack behaviors.

Internet of Things (IoT) technology has been incorporated into the majority of people’s everyday lives and places of employment due to the quick development in information technology. Modern agricultural techniques increasingly use the well-known and superior approach of managing a farm known as “smart farming”. Utilizing a variety of information and agricultural technologies, crops are observed for their general health and productivity. This requires monitoring the condition of field crops and looking at many other indicators. The goal of smart agriculture is to reduce the amount of money spent on agricultural inputs while keeping the quality of the final product constant. The Internet of Things (IoT) has made smart agriculture possible through data collection and storage techniques. For example, modern irrigation systems use effective sensor networks to collect field data for the best plant irrigation. Smart agriculture will become more susceptible to cyber-attacks as its reliance on the IoT ecosystem grows, because IoT networks have a large number of nodes but limited resources, which makes security a difficult issue. Hence, it is crucial to have an intrusion detection system (IDS) that can address such challenges. In this manuscript, an IoT-based privacy-preserving anomaly detection model for smart agriculture has been proposed. The motivation behind this work is twofold. Firstly, ensuring data privacy in IoT-based agriculture is of the utmost importance due to the large volumes of sensitive information collected by IoT devices, including on environmental conditions, crop health, and resource utilization data. Secondly, the timely detection of anomalies in smart agriculture systems is critical to enable proactive interventions, such as preventing crop damage, optimizing resource allocation, and ensuring sustainable farming practices. In this paper, we propose a privacy-encoding-based enhanced deep learning framework for the difficulty of data encryption and intrusion detection. In terms of data encoding, a novel method of a sparse capsule-auto encoder (SCAE) is proposed along with feature selection, feature mapping, and feature normalization. An SCAE is used to convert information into a new encrypted format in order to prevent deduction attacks. An attention-based gated recurrent unit neural network model is proposed to detect the intrusion. An AGRU is an advanced version of a GRU which is enhanced by an attention mechanism. In the results section, the proposed model is compared with existing deep learning models using two public datasets. Parameters such as recall, precision, accuracy, and F1-score are considered. The proposed model has accuracy, recall, precision, and F1-score of 99.9%, 99.7%, 99.9%, and 99.8%, respectively. The proposed method is compared using a variety of machine learning techniques such as the deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), and long short-term memory (LSTM).

Cloud computing is the distributed computing paradigm continually exposed to different attacks and threats of various origins. The data stored in the cloud framework is easier for external and internal intruders, as access to the cloud framework is done through internet services. Various intrusion detection (ID) methods are developed to detect network intruders in the cloud, but these methods are not primarily effective in generating accurate detection results. Hence, an effective intrusion detection system (IDS) is designed to solve the security issues that unfavorably influence the sustainable development of the cloud and enhance the protection of the cloud from malicious attacks. The IDS is modeled using the proposed Feedback Deer Hunting Optimization (FDHO)-based Deep Residual network to detect network intrusions. However, the proposed FDHO algorithm is designed by integrating Feedback Artificial Tree (FAT) with Deer Hunting Optimization (DHOA), respectively. Moreover, the detection of malicious attacks is carried out using a Deep Residual network that significantly increases the training speed, reduces the computational complexity, and generates effective detection results. The performance of the proposed method is comparatively analyzed with the existing techniques, such as Stacked Contractive Auto-Encoder and Support Vector Machine (SCAE+SVM), Artificial Neural Network with ant bee colony optimization algorithm+fuzzy clustering (ANN+ABC+fuzzy clustering), Improved dynamic immune algorithm (IDIA), and Normalized K-means (NK) clustering algorithm with RNN named, (NK-RNN), FAT-based Deep Residual network, and DHOA-based Deep Residual network using the BoT-IoT dataset and KDD cup-99 dataset. The proposed method achieved outstanding performance by considering the metrics, like specificity, accuracy, and sensitivity, with the values of 0.9526, 0.9498, and 0.9214 using the BoT-IoT dataset.

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

The article gives a general idea of intrusion detection systems (IDS) and machine learning, presents a classification of machine learning methods. The most commonly used data sets for training IDS are considered. The main performance indicators used to assess the IDS are described. A review of modern research on the development of intrusion detection methods using machine learning is made, the strengths and weaknesses of each solution are described. The data sets used in them, the obtained estimates of the effectiveness of the proposed intrusion detection methods, are analyzed. Based on the results of the analysis, development trends, unresolved problems and promising areas of research were identified.

Intrusion detection system plays an important role in ensuring information security, and the key technology is to accurately identify various attacks in the network. Due to huge increase in network traffic and different types of attacks, accurately classifying the malicious and legitimate network traffic is time consuming and computational intensive. Recently, more and more researchers applied deep neural networks (DNNs) to solve intrusion detection problems. Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN), the two main types of DNN architectures, are widely explored to enhance the performance of intrusion detection system. In this paper, we made a systematic comparison of CNN and RNN on the deep learning based intrusion detection systems, aiming to give basic guidance for DNN selection.