Enhancing Intrusion Detection Using Deep Neural Networks in Cloud Environments

As the range of security attacks increases across diverse network applications, intrusion detection systems are of central interest. Such detection systems are more crucial for the Internet of Things (IoT) due to the voluminous and sensitive data it produces. However, the real-world network produces imbalanced traffic including different and unknown attack types. Due to this imbalanced nature of network traffic, the traditional learning-based detection techniques suffer from lower overall detection performance, higher false-positive rate, and lower minority-class attack detection rates. To address the issue, we propose a novel deep generative-based model called Class-wise Focal Loss Variational AutoEncoder (CFLVAE) which overcomes the data imbalance problem by generating new samples for minority attack classes. Furthermore, we design an effective and cost-sensitive objective function called Class-wise Focal Loss (CFL) to train the traditional Variational AutoEncoder (VAE). The CFL objective function focuses on different minority class samples and scrutinizes high-level feature representation of observed data. This leads the VAE to generate more realistic, diverse, and quality intrusion data to create a well-balanced intrusion dataset. The balanced dataset results in improving the intrusion detection accuracy of learning-based classifiers. Therefore, a Deep Neural Network (DNN) classifier with a unique architecture is then trained using the balanced intrusion dataset to enhance the detection performance. Moreover, we utilize a challenging and highly imbalanced intrusion dataset called NSL-KDD to conduct an extensive experiment with the proposed model. The results demonstrate that the proposed CFLVAE with DNN (CFLVAE-DNN) model obtains promising performance in generating realistic new intrusion data samples and achieves superior intrusion detection performance. Additionally, the proposed CFLVAE-DNN model outperforms several state-of-the-art data generation and traditional intrusion detection methods. Specifically, the CFLVAE-DNN achieves 88.08% overall intrusion detection accuracy and 3.77% false positive rate. More significantly, it obtains the highest low-frequency attack detection rates for U2R (79.25%) and R2L (67.5%) against all the state-of-the-art algorithms.

As organizations increasingly rely on network services, the prevalence and severity of Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks have emerged as significant threats. The cornerstone of effectively addressing these challenges lies in the timely and precise detection capabilities offered by advanced intrusion detection systems (IDS). Hence, an innovative IDS framework is introduced that seamlessly integrates the extended Berkeley Packet Filter (eBPF) with powerful machine learning algorithms—specifically Decision Tree (DT), Random Forest (RF), Support Vector Machine (SVM), and TwinSVM—enabling unparalleled real‐time detection of DDoS attacks. This cutting‐edge solution provides a robust and scalable IDS framework to combat DoS and DDoS threats with high efficiency, leveraging eBPF's capabilities within the Linux kernel to bypass typical user space constraints. The methodology encompasses several key steps: (a) Collection of data from the renowned CIC‐IDS‐2017 repository; (b) Processing the raw data through a meticulous series of steps, including transmission, cleaning, reduction, and discretization; (c) Utilizing an ANOVA F‐test for the extraction of critical features from the preprocessed data; (d) Application of various ML algorithms (DT, RF, SVM, and TwinSVM) to analyze the extracted features for potential intrusion; (e) Implementing an eBPF program to capture network traffic and harness trained model parameters for efficient attack detection directly within the kernel. The experimental results reveal outstanding accuracy rates of 99.38%, 99.44%, 88.73%, and 93.82% for DT, RF, SVM, and TwinSVM, respectively, alongside remarkable precision values of 99.71%, 99.65%, 84.31%, and 98.49%. This high‐speed, accurate detection model is ideally suited for high‐traffic environments such as data centers. Furthermore, its foundational architecture paves the way for future advancements, including the potential integration of eBPF with XDP to achieve even lower‐latency packet processing. The experimental code is available at the GitHub repository link: https://github.com/NemalikantiAnand/Project .

The rapid growth of the Internet of Things (IoT) has introduced considerable security challenges, making Intrusion Detection Systems (IDS) essential for protecting connected devices from cyber threats. This paper presents an Artificial Intelligence (AI)-driven Intrusion Detection System (IDS) designed for IoT environments, utilizing machine learning and anomaly detection techniques. The system leverages the NSL-KDD dataset to distinguish between normal and anomalous network traffic. We implemented multiple feature selection techniques, including correlation-based selection, Recursive Feature Elimination (RFE), and LASSO, to optimize model performance. Various machine learning classifiers, including Random Forest (RF), Bagging, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN), were evaluated using key performance metrics such as accuracy, recall, precision, and AUC-ROC. Experimental results indicate that Random Forest and Bagging outperformed other models, achieving the highest accuracy of 99.89%, with an AUC-ROC of 99.88%, outperforming other models in intrusion detection. Additionally, feature selection methods effectively reduced dataset dimensionality while maintaining high detection performance. Despite these promising results, challenges such as high training time, false positives, and real-time adaptability remain critical concerns for practical deployment in IoT systems.

Data security is regarded to be one of the crucial challenges in this fast-growing internet world. Data generated through internet is exposed to various types of vulnerabilities and exploits. Security mechanisms such as Intrusion Detection System (IDS) are designed to detect various types of vulnerabilities and attacks. Various Machine Learning (ML) and Deep Learning (DL) techniques are used for building IDS. In this paper, we aim to build Deep Neural Network (DNN)-based IDS for attack detection and classification. DNN technique has certain challenges such as complex network structure, co-adaptation of feature vectors, over-fitting, to name a few. We aim to address these challenges by using AntiRectifier layer and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian Noise. In this paper, we have evaluated DNN-based IDS using NSL-KDD, UNSW_NB-15 and CIC-IDS-2017 dataset. The experimental results show that DNN-based IDS with AntiRectifier layer outperforms compared to ML techniques such as Decision Tree (DT), Random Forest (RF), Naïve Bayes (NB), Support Vector Machine (SVM), k-Nearest Neighbours (k-NN) and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian noise in terms of accuracy, precision, recall, f-score, and false positive rate.

Intrusion detection plays a critical role in safeguarding computer networks from malicious activities and unauthorized access. Traditional machine learning (ML) models have been widely employed for intrusion detection, but their effectiveness can be limited due to the complex and evolving nature of network attacks. An efficient Convolutional Neural Network (CNN) that utilizes one-dimensional convolutions, batch normalization, and max pooling layers is designed to capture the attack patterns in network traffic data. By leveraging the inherent feature extraction capabilities of CNNs, the proposed architecture demonstrates improved performance in identifying network intrusions compared to traditional ML models. The effectiveness of the novel CNN architecture is evaluated by conducted comprehensive experiments on two benchmark intrusion detection datasets. The designed CNN performance was compared with four other ML models such as logistic regression, k-nearest neighbors, decision trees, and random forest. The experimental results revealed that the proposed CNN architecture outperformed the traditional ML models with highest accuracy of 97.68% and 97.39% and highest F1-score of 97.68% and 97.40% for. UNSW-NB15 and CICIDS2017 datasets, respectively. The proposed CNN architecture serves as a promising alternative to traditional ML models, offering improved performance in identifying and mitigating network attacks.

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.

Accurate rainfall forecasting is crucial in activities such as agricultural planning, water resource management, and flood preparedness, so failure to accurately forecast rainfall might undermine these activities. This study aimed to improve the accuracy of daily rainfall prediction in Hai district, Kilimanjaro region, Tanzania, a region characterised by a bimodal rainfall pattern, by comparing rainfall prediction accuracies of Traditional Machine Learning (TML) and Deep Learning (DL) models. The 25-year daily rainfall dataset for Hai district was first pre-processed by cleaning, normalisation, and splitting into training (first 60%), validation (next 20%), and test (last 20%) sets. TML models (K-Nearest Neighbours (KNN) through its variant KNN Regressor and Support Vector Machine (SVM) through its variant Support Vector Regressor (SVR)) were developed, trained, and their performances compared with developed and trained DL models (Long Short-Term Memory (LSTM) and Gated Recurrent Units (GRU)). Each model’s test performance was evaluated using the Root Mean Squared Error (RMSE) metric. The findings revealed that the DL models, LSTM and GRU, achieved test RMSE scores of 6.35 mm and 6.49 mm, respectively, while the TML models, KNN and SVM, achieved test RMSE scores of 6.61 mm and 10.42 mm, respectively. The study demonstrated that DL models are more effective for accurate rainfall forecasting than TML models in regions with complex rainfall patterns. The insights gained will guide the development of more reliable, location-specific weather prediction systems, ultimately supporting informed decision-making in agriculture, environmental management, and flood risk reduction in Tanzania and other regions facing similar climatic challenges

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

A high growth rate in network traffic and the complexity of cyber threats have made it necessary to create more effective and flexible intrusion detection systems. Most traditional Network-based Intrusion Detection Systems (NIDS) can become weak at detecting new patterns of attacks due to the use of obsolete data or traditional machine learning models. To overcome the mentioned constraints, the current research presents a new deep learning solution that combines Sequential Deep Neural Networks (DNN) and Rectified Linear Unit (ReLU) activation unit with an Extra Tree Classifier feature selection procedure. The proposed model is trained and tested on the new rich and up-to-date UNSW-NB15 set, which provides a realistic reflection of the real-life network traffic and attack vectors. The interesting novelty of this study is the tactical use of ReLU-based DNN combined with feature optimization through the Extra Tree Classifier, which not only overcomes general problems like vanishing gradients and overfitting but also greatly increases the interpretability of the model and the efficiency of its computation. This dimensional reduction of the feature space (43 to only 8 highly relevant features) retains the high accuracy of the model but with better inference speed, which is a crucial aspect of the real-time deployment of NIDS. The results show that with the Sequential DNN approach, the binary class (0 for normal and 1 for attack records) achieved 97.93% accuracy, 97% Precision, 97% Recall and 97% F1-score. Furthermore, the detailed experimental testing, such as ROC curves and Confusion Matrices, confirmed that the Sequential DNN performed well in comparison to other Existing Studies. These findings underscore the effectiveness of deep learning architectures enhanced with optimized feature selection in detecting network intrusions, making the proposed system a promising solution for securing critical infrastructure in sectors such as finance, healthcare, and government networks.

In the fast-changing era of data communication, cyber-attacks and unauthorized access pose a significant threat to system and network security. Conventional Intrusion Detection Systems (IDS) are plagued by low accuracy and high false positives, which erode their usefulness in real-time intrusion detection. To overcome this issue, a new hybrid approach is proposed where Rough Set Theory (RST) is used for feature selection and Support Vector Machine (SVM) for classification. The main aim is to improve the detection accuracy while, at the same time, minimizing the complexity and dimensionality of data and processing. RST successfully filters out the most important features from the network traffic data and eliminates redundant or irrelevant attributes before forwarding the pre-processed data to the SVM classifier. This, besides lowering the processing complexity, also enhances the classification performance. The novelty lies in the combined application of RST and SVM, hence offering a more efficient alternative to existing methods like Principal Component Analysis (PCA). The proposed IDS exhibits enhanced detection accuracy with an appreciable reduction in false positives, hence offering a more efficient and reliable intrusion detection mechanism.

The swift growth of cloud computing has heightened cybersecurity vulnerabilities, demanding robust intrusion detection systems (IDS). Conventional IDS models face challenges, such as excessive false positives and limited flexibility. This study introduces Spinal Stacked AutoEncoder Net (SpinalSAENet), an innovative hybrid deep-learning-based IDS that merges SpinalNet and Deep Stacked AutoEncoders (DSAE) to enhance anomaly detection and data integrity verification. The system employs feature extraction and Chebyshev distance-based fusion to improve classification, while Principal Component Analysis (PCA) is utilised to reduce dimensionality, thereby increasing computational efficiency. When tested on the Bot-IoT dataset, SpinalSAENet demonstrated superior performance with 96.87% accuracy, 95.4% recall, 96.1% precision, and a 95.7% F1-score, surpassing Decision Trees, Random Forests, and Support Vector Machines. The incorporation of SHA-256 hashing and Merkle tree proofs ensures data integrity, offering a multitiered security approach. Its streamlined architecture and cloud-native scalability (Docker and Kubernetes) facilitate real-time deployment in cloud environments. This paper presents a highly precise and scalable IDS framework capable of real-time intrusion detection and data integrity verification. Subsequent research will investigate the resistance to adversarial attacks, explainable AI, and serverless deployment to further enhance cloud security.

Deep neural networks (DNN) are highly effective in a number of tasks related to machine learning across different domains. It is quite challenging to apply the information gained to textual data because of its graph representation structure. This article applies innovative graph structures and protection techniques to secure wireless systems and mobile computing applications. We develop an Intrusion Detection System (IDS) with DNN and Support Vector Machine (SVM) to identify adversarial inversion attacks in the network system. It employs both normal and abnormal adversaries. It constantly generates signatures, creates attack signatures, and refreshes the IDS signature repository. In conclusion, the assessment indicators, including latency rates and throughput, are used to evaluate the effectiveness and efficiency of the recommended framework with Random Forest. The results of the proposed model (SVM with DNN) based on adversarial inversion attacks were better and more efficient than traditional models, with a detection rate of 93.67% and 95.34% concerning latency rate and throughput. This article also compares the proposed model (SVM with DNN) accuracy with other classifiers and the accuracy comparison for feature datasets of 90.3% and 90%, respectively.

Intrusion detection systems monitor network or host packets in an attempt to detect malicious activities on a system. Anomaly detection systems have success in exposing new attacks, commonly referred to as ‘zero’ day attacks, yet have high false positive rates. False positive events occur when an activity is flagged for investigation yet it was determined to be benign upon analysis. Computational power and valuable resources are wasted when the irrelevant data is processed, data flagged, analyst alerted, and the irrelevant data is finally disregarded. In an effort to make intrusion detection systems more efficient the false positive rate must be reduced. This paper proposes a model for reducing false positives using data mining techniques by combining support vector machines (SVM), decision trees, and Naive Bayes.

The proliferation of connected devices and increasingly sophisticated cyberattacks necessitate an evolution beyond traditional, single-paradigm intrusion detection systems (IDS). Signature-based methods fail against zero-day threats, while pure anomaly-based systems often suffer from high false-positive rates. This study proposes and evaluates a novel Hybrid Intelligence-Based Model for Network Intrusion Detection that synergistically integrates signature, anomaly, and AI-driven machine learning components. The core innovation is a soft-voting ensemble mechanism combining three robust classifiers Random Forest (RF), Support Vector Classifier (SVC), and Extreme Gradient Boosting (XGBoost) to achieve a resilient and highly accurate detection framework. Using a rigorously preprocessed, class-balanced subset of the CIC-IDS2017 dataset, the ensemble model achieved 99.2% accuracy on the multi-class test set. A critical feature ablation study demonstrated that this near-perfect performance was maintained even after excluding the single most dominant feature (Destination Port), validating the model's robustness and reliance on diverse, generalized flow characteristics (e.g., TCP flag dynamics and inter-arrival times). The findings confirm the viability of AI-driven hybridization as a superior, adaptive defense strategy against both known and emerging network threats.

An Efficient Cyber Assault Detection System using Feature Optimization for IoT-based Cyberspace