Golden eagle optimization approach for feature selection and XGBoost algorithm-based intrusion detection system in wireless mesh networks of smart grid

Intrusion Detection Systems(IDSs) are widely used to detect both known attacks and unknown attacks performed by internal and external attackers in wireless networks. However, challenging issues for developing IDSs in Wireless Mesh Networks (WMNs) are 1) supporting interoperability and 2) handling volatile parameters. In addition, security standards for WMN are still in draft stage, and to protect the WMN, IDSs of similar wireless networks such as wireless sensor, Ad-Hoc, MANET can be adopted, but the best performance is not guaranteed. In this paper, we have classified the existing IDSs for wireless networks into four categories namely single layer IDS, cross-layer IDS, reputation-based IDS, reputation based cross-layer IDS, and analyzed the performance of these IDSs with core-layer attacks and detection methodology. Based on our analysis, we address the loopholes in existing IDSs and specify research directions for strengthening the existing IDSs and for developing new efficient IDSs with respect to backbone mesh and client mesh networks.

Network intrusion detection system are significant features that contribute to the enterprises and organization network success. In the past decade, Intrusion Detection system (IDS) using several methods have been proposed and implemented to safeguard the networks within an organization to be reliable, secure, and readily available. Although, some of these methods are built utilizing machine learning concepts. IDS utilizing machine learning techniques are accurate, effective and efficient in spotting attacks. However, the machine learning model performance reduces with high dimensional intrusion dataset. Therefore, it is sacrosanct to implement an efficient feature selection technique that can generate a great impact on the classification stage. Also, the feature selection phase is the most serious phase in IDS based on machine learning. This phase is expensive both in time and efforts. Furthermore, most of the proposed machine learning intrusion detection system suffered from low detection accuracy and high false positive rate when the models are experimented on high dimensional dataset. The aim of this paper is to propose a binary firefly algorithm (BFFA) based feature selection for IDS. We first performed normalization in the first stage of the model. Subsequently, the BFFA algorithm was used for feature selection stage. We adopted random forest algorithm for the classification phase. The experiment was performed on high dimensional University of New South Wales-NB 2015 (UNSW-NB15) dataset with seventy five percent of the data used for training the model and twenty percent for testing. The findings showed an accuracy of 99.72%, detection rate of 99.84%, precision of 99.27%, recall of 99.84% and F-score of 99.56%. The results were gauge with the state-of-the-art results and our results were found outstanding.

Wireless Mesh Networks (WMNs) are a promising technology to provide the wireless internet connectivity. WMNs are becoming a popular choice for wireless internet service providers to offer internet connectivity as it allows a fast, easy and inexpensive network deployment. However, security in WMNs is still in its infancy. Security and privacy has been a major concern in WMNs. WMNs are susceptible to broad variety of attacks due to its open medium, dynamic topology and lack of physical security. WMNs are more vulnerable in Network layer. Several attacks are possible in the network layer. Some of the attacks have possible solutions but there is no solution for to detect Rushing attack which leads to the Denial of Service. In this paper, the authors proposed Cross-Layer Intrusion Detection System (CLIDS) for Rushing attack. We evaluated the performance of our technique using network simulator 2. Simulation results show that CLIDS has less false positive and false negative rates than single layer intrusion detection system.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

In light of rapid technological developments, a marked rise in global internet usage has contributed to increased sensitive data flow across networks. This increase leads to the diversification of malicious attacks and makes cyber security requirements more evident. In order to ensure network security, intrusion detection systems stand out as an essential component. Intrusion detection systems detect suspicious and malicious activities over network traffic, allowing network administrators and experts to monitor current threats continuously. In anomaly-based systems, machine learning approaches are applied to identify abnormal attempts in network traffic. This study presents a feature selection framework for anomaly-based attack detection systems by combining machine learning and heuristic algorithms. This proposed study aims to improve the performance of IDSs in terms of both time and attack detection by selecting features with heuristic approaches. In the proposed approach, PSO, FPA, DE feature selection methods and LR, DT, RF, KNN, NB, GB, LDA, QDA, AdaBoost, and NN machine learning algorithms are used to perform anomaly-based comparative analyses on KDDCup99, NSL-KDD, UNSW-NB15, CSE-CIS-IDS2018 datasets. Analyses conducted on these datasets with various features demonstrated that models employing feature selection achieved an approximate two-hundred-percent improvement in time efficiency compared to models that did not utilize feature selection. It has been determined that DE, PSO, and FPA, which are used for feature selection, provide high-accuracy outputs when combined with different classifiers. When the analysis results are assessed according to the specified criteria, the highest F1-Score values achieved are as follows: 0.9972 for the DE method in GB, 0.9969 for the PSO method in GB, and 0.9948 for the FPA method in GB, on the KDD CUP 99 dataset. In the NSL-KDD, used as the second dataset, the DE method achieved a score of 0.9713 in GB, the PSO method reached 0.9112 in DT, and the FPA method obtained 0.9894 in RF, respectively. In the third dataset, UNSW-NB15, the DE method achieved a score of 0.9507 in DT, the PSO method reached 0.9068 in DT, and the FPA method obtained 0.8924 in NN. Finally, in the CSE-CIC-IDS2018 dataset, the highest scores achieved using the RF algorithm were 0.99986 for the DE method, 0.99989 for the PSO method, and 0.99987 for the FPA method, based on feature selection. The obtained results underscore the critical role of dataset generation processes and network traffic dynamics in enhancing the performance of intrusion detection systems. Additionally, the significance of feature selection was highlighted. These findings offer valuable insights and present opportunities for further advancements in future research.

The limitation of signature-based Intrusion Detection systems has given rise for the popularity of Machine learning (ML) approaches r for building such intrusion detection systems (IDSs). ML is a sub-filed of Artificial Intelligence that enables algorithms to learn from data and its applications have been widely accepted and used in many domains. To achieve a promising ML-based model that can identify attacks and intrusions in networks and the cyber space, different stages of machine learning approach like pre-processing, attribute selection, model building, hyper parameter tuning can be very important. CICIDS2017 intrusion dataset was used for all the experimentations. This study focuses on building cyber threat detection model based on the ensemble feature selection and classification method. Innovative approaches were used for the analysis and pre-processing of the dataset. Thereafter, XGboost algorithm was used for selecting relevant features from the default input attributes in each of the captures. Thereafter, the reduced features were employed in the identification of cyber intrusions. The average accuracy achieved in the 8 captures of the dataset is 98% while precision is 0.98. Also, recall is 0.98, f1-score is 0.98 while AUC ROC score is 0.99. The study concluded that XGBoost-based model was able to achieve promising results based on the proper dataset encoding, feature importance-based feature selection and tuning of the algorithm for intrusion identification.

Network attacks have become necessary in today’s time due to increased network traffic. To determine whether network traffic is normal or anomalous a supervised machine learning system is developed. A network intrusion detection system (IDS) is a must-have piece of a security system. This proposed study aims to discover new patterns automatically from substantial quantities of network data, reducing time manually compiling intrusion and normal behavior patterns. The best model in terms of detection success rate was discovered using a supervised learning algorithm and feature selection method. AdaBoost outperforms Neural Network, kNN, and Naive Bayes in supervised machine learning with feature selection in this study, with a detection accuracy of 100.00%, 99.30%, 91.60%, and 99.70%, respectively. The Network Intrusion Detection dataset is used to classify network intrusions to evaluate the study and it has also been used in past studies. On the other hand, the proposed model proved to be more effective than other studies in terms of intrusion detection. The proposed approach can be used in various fields, including finance, health, and transportation. Furthermore, additional parameter tuning could be added, and different feature selection techniques could be used to improve the performance of the classifiers.

Network Intrusion Detection Systems (NIDS) are utilized to find hostile network connections. This can be accomplished by looking at traffic network activity, but it takes a lot of work. The NIDS heavily utilizes approaches for data extraction and machine learning to find anomalies. In terms of feature selection, NIDS is far more effective. This is accurate since anomaly identification uses a number of time-consuming features. Because of this, the feature selection method influences how long it takes to analyze movement patterns and how clear it is. The goal of the study is to provide NIDS with an attribute selection approach. PSO has been used for that purpose. The Network Intrusion Detection System that is being developed will be able to identify any malicious activity in the network or any unusual behavior in the network, allowing the identification of the illegal activities and safeguarding the enormous amounts of confidential data belonging to the customers from being compromised. In the research, datasets were produced utilising both a network infrastructure and a simulation network. Wireshark is used to gather data packets whereas Cisco Packet Tracer is used to build a network in a simulated environment. Additionally, a physical network consisting of six node MCUs connected to a laptop and a mobile hotspot, has been built and communication packets are being recorded using the Wireshark tool. To train several machine learning models, all the datasets that were gathered—created datasets from our own studies as well as some common datasets like NSDL and UNSW acquired from Kaggle—were employed. Additionally, PSO, which is an optimization method, has been used with these ML algorithms for feature selection. In the research, KNN, decision trees, and ANN have all been combined with PSO for a specific case study. And it was found demonstrated the classification methods PSO + ANN outperformed PSO + KNN and PSO + DT in this case study.

Nature-inspired intrusion detection system for protecting software-defined networks controller

Cloud computing (CC) is an internet-enabled environment that provides computing services such as networking, databases, and servers to clients and organizations in a cost-effective manner. Despite the benefits rendered by CC, its security remains a prominent concern to overcome. An intrusion detection system (IDS) is generally used to detect both normal and anomalous behavior in networks. The design of IDS using a machine learning (ML) technique comprises a series of methods that can learn patterns from data and forecast the outcomes consequently. In this background, the current study designs a novel multi-objective seagull optimization algorithm with a deep learning-enabled vulnerability detection (MOSOA-DLVD) technique to secure the cloud platform. The MOSOA-DLVD technique uses the feature selection (FS) method and hyperparameter tuning strategy to identify the presence of vulnerabilities or attacks in the cloud infrastructure. Primarily, the FS method is implemented using the MOSOA technique. Furthermore, the MOSOA-DLVD technique uses a deep belief network (DBN) method for intrusion detection and its classification. In order to improve the detection outcomes of the DBN algorithm, the sooty tern optimization algorithm (STOA) is applied for the hyperparameter tuning process. The performance of the proposed MOSOA-DLVD system was validated with extensive simulations upon a benchmark IDS dataset. The improved intrusion detection results of the MOSOA-DLVD approach with a maximum accuracy of 99.34% establish the proficiency of the model compared with recent methods.

<p>Cyber-attacks are rapidly increasing in the internet era due to the growth of information technology. The distributed denial of service (DDoS) attacks are increasing dramatically due to the distributed services in cloud networks. In this paper, a new Intrusion Detection System (IDS) is proposed to improve the performance of the networks by detecting DDoS attacks effectively in wireless networks. In this work, we propose a new feature selection method called Split Filter Feature Selection and Spotted Hyena Optimization Based Feature Optimization Method (SFSH-FOM) to select the most contributed features that are helpful for enhancing the classification accuracy. In this work, a new deep learning algorithm named Fuzzy Temporal Features incorporated Convolutional Neural Network (FT-CNN) is proposed for performing effective classification. Here, a new cross layer feature fusion technique is also proposed by using FT-CNN and LSTM for enhancing the performance. The experiments have been carried out to evaluate the proposed IDS using the standard datasets, namely the KDD’99 dataset, the NSL-KDD dataset, and the DDoS dataset by considering the evaluation metrics such as detection accuracy, recall, precision, and F1-score, and it has also been proved as better than other IDSs in terms of accuracy and false alarm rate.</p> <p> </p>

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

In recent years industrial control systems using networks for communication and Transmission Control Protocol (TCP) are normally used in supervisory layer, so malicious outsider and insider can attack through network. One of useful based model methods for fault detection and isolation is Unknown Input Observers (UIO). Some previous works that used UIO, observe dynamic of the physical system to detect attacks. This paper first describes how attacker can make Denial of Service (DoS) in active queue management and by using UIO, designed Network Intrusion Detection System (NIDS) that use fluid flow model, then fusion information of NIDS and Host Intrusion Detection Systems (HIDS). Distributed Intrusion Detection System (DIDS), detects abnormal behavior of network and physical system and alarms for three state: free attack, DoS and deception attack. So false negative for free attack and false positive for DoS attack are being reduced. Simulation results demonstrate the high success level of this approach for detecting attacks.

The intrusion detection system (IDS) deals with huge amount of data which contains irrelevant and redundant features causing slow training and testing process, higher resource consumption as well as poor detection rate. To overcome these limitations, we introduce the concept of lightweight IDS. The lightweight IDSs are small, powerful, and flexible enough to be used as permanent elements of the network security infrastructure. In this paper, we propose a novel concept for building lightweight IDS based on two different approaches. The first approach is using a features selection approach by applying fuzzy enhanced support vector decision function (Fuzzy ESVDF) algorithm. This approach is able to improve system efficiency. The second approach is using IDS classification scheme. The IDS classification scheme divides the detection process into four types according to the TCP/IP network model (application layer IDS, transport layer IDS, network layer IDS, and link layer IDS). This IDS classification scheme enhances an organizationpsilas ability to detect most types of attack (improving system accuracy and generality). Also, it improves IDS scalability and extendibility. To design the proposed system, several experiments have been conducted, and they indicate that the proposed lightweight IDS can deliver satisfactory system performance.