ID-SOMGA: A Self Organising Migrating Genetic Algorithm-Based Solution for Intrusion Detection

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

With the wide application of information technolo-gies in communication based train control (CB TC) systems, the information security risks it confronts to are ever increasing. It is very difficult to design an intrusion detection system (IDS) which can detect both known and unknown cyber attacks with high true positive rate (TPR) and low false positive rate (FPR), simultaneously. In this paper, we propose a hybrid intrusion detection system (RIDS) which is composed of a signature-based intrusion detection system (SIDS) and an anomaly-based intrusion detection system (AIDS). An improved stacking ensemble algorithm (ISEA) is proposed to enhance the TPR of the SIDS which uses weighted classification probabilities outputted by base-classifiers to generate meta-features for the meta-classifier. The FPR of the AIDS is significantly reduced through adopting the proposed false positive elimination strategy (FPES). In addition, a Bayesian optimization algorithm is used for hyper-parameters adjustment to optimize the overall performance of the RIDS. The proposed RIDS is evaluated using both a KDD99 dataset and a CBTC dataset collected on a hardware-in-the-Ioop simulation platform. For the KDD99 dataset, the TPR and FPR of the proposed RIDS are 98.6% and 1.3%, respectively. For the CBTC dataset, the TPR and FPR are 98.1% and 1.1 %, respectively. Based on the performance comparison among different RIDSs, it is can be concluded that the proposed RIDS is superior to the existing RIDS in both TPR and FPR.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Attack-aware Security Function Management

In recent years, with increasing use of internet the computer systems are facing many number of security issues. Intrusion detection system (IDS) is one of the principal components of any information security system. Identification of anomalous activity in computer network is first step in identifying the threat to information system. Our focus is mainly on Genetic algorithm (GA) based anomaly detection technique, as GA is one of the most effective evolutionary techniques for machine learning. In this paper Genetic algorithm is applied for network intrusion detection. Our approach for optimization specifically focusing on false positive rate. Reduction in false positive rate also improves accuracy and performance. The limitation of other techniques of accuracy, false positive rates has been addressed in this paper. Experimental results show the efficient detection rates based on KDD99cup datasets which is a standard dataset for intrusion detection.

Chapter 5 - Intrusion Prevention and Detection Systems

Computer networks are being attacked every day. Intrusion detection systems (IDS) are used to detect and reduce effects of these attacks. The currently used of hybrid intrusion detection systems that was base on signature and anomaly based detection techniques were became inefficient for detecting attacks because it have nearly less than or equal to 95.5% for the detection rate and 1.8% for false positive rate, nowadays these values are unsatisfied for the detection so that the needs to enhanced hybrid intrusion detection system has became the most important issues. In this study, the enhanced hybrid intrusion detection system has been proposed to provide better results with high accuracy of the detection rate and reduce the value of false positive rate that will done by proposing new method based on decision tree of data mining techniques that is based on C4.5 algorithm to show that the proposed model is more efficient and it gives better optimum results.

With the ever increasing use of computers for critical systems, computer security, the protection of data and computer systems from intentional, malicious intervention, is attracting much attention. Among the methods for defence, intrusion detection , i.e. the application of a tool to help the operator identify ongoing or already perpetrated attacks has been the subject of considerable research in the past ten years. A key problem with current intrusion detection systems is the high number of false alarms they produce. This thesis presents research into why false alarms are and will remain a problem and proposes to apply results from the field of information visualisation to the problem of intrusion detection. This was thought to enable the operator to correctly identify false (and true) alarms, and also aid the operator in identifying other operational characteristics of intrusion detection systems. Four different visualisation approaches were tried, mainly on data from web server access logs. Two direct approaches were tried; where the system puts the onus of identifying the malicious access requests on the operator by way of the visualisation. Two indirect approaches were also tried; where the state of two self learning automated intrusion detection systems were visualised to enable the operator to examine their inner workings. This with the hope that in doing so, the operator would gain an understanding of how the intrusion detections systems operated and whether that level of operation, and the quality of the output, was satisfactory. Several experiments were performed and many different attacks in web access data from publicly available web servers were found. The visualisation helped the operator either detect the attacks herself and more importantly the false alarms. It also helped her determine whether other aspects of the operation of the self learning intrusion detection systems were satisfactory.

Internet worms pose a serious threat to networks. Most current intrusion detection systems (IDSs) take signature matching approach to detect worms. Given the fact that most signatures are developed manually, generating new signatures for each variant of a worm incurs significant overhead. In this paper, we propose a difference-based scheme which differences worm flows and normal flows to generate robust worm signatures. The proposed scheme is based on two observational facts - worm flows contain several invariant portions in their payloads, and core worm codes do not exist in normal flows. It uses samples of worm flows detected by available means to extract common tokens. It then differences the set of these tokens with those of normal flows and generates signature candidates. By using such signatures within enterprises, out of reach of worm writers, the possibility of being tricked by worm writers can be reduced. We evaluate the proposed scheme using real network traffic traces that contains worms. Experiment results show that the proposed scheme exhibits high detection rate with low false positives.

An Intrusion Detection System (IDS) gathers information from a computer or a network, and analyzes this information to identify possible security breaches against the system or the network. An observation of various IDSs available in literature shows distinct preferences for detecting a certain class of attack with improved accuracy, while performing moderately on the other classes. The availability of enormous computing power has made it possible for developing and implementing IDSs of different types on the same network. The integration of the decisions coming from different IDSs has emerged as a technique that could strengthen the final decision. Sensor fusion can be defined as the process of collecting information from multiple and possibly heterogeneous sources and combining them to obtain a more descriptive, intuitive and meaningful result (1). An analysis of the poorly detected attacks reveals the fact that the attacks are characterized by features that do not discriminate themmuch. In this chapter, we prove the distinct advantages of sensor fusion over individual IDSs. All the related work in the field of sensor fusion has been carried out mainly with one of the methods like probability theory, evidence theory, voting fusion theory, fuzzy logic theory or neural network in order to aggregate information. The Bayesian theory is the classical method for statistical inference problems. The fusion rule is expressed for a system of independent learners, with the distribution of hypotheses known a priori. The Dempster-Shafer evidence theory is considered a generalized Bayesian theory. It does not require a priori knowledge or probability distribution on the possible system states like the Bayesian approach and it is mostly useful when modeling of the system is difficult or impossible (2). The improved performance of multiple IDSs using rule-based fusion and deta-dependent decision fusion has been demonstrated in the work of Thomas and Balakrishnan (3). An attempt to prove the distinct advantages of sensor fusion over individual IDSs is done in this chapter using the Chebyshev inequality. Fusion threshold bounds were derived using the principle of Chebyshev inequality at the fusion center using the false positive rates and detection rates of the IDSs. The goal was to achieve best fusion performance with the least amount of model knowledge, in a computationally inexpensive way. The anomaly-based IDSs detect anomalies beyond a set threshold level in the features it detects. Threshold bounds instead of a single threshold give more freedom in steering system properties. Any threshold 4

Advances in wireless communications and microelectronics have spearheaded the development of unmanned aerial vehicles (UAVs), which can be used to augment a ground network composed of sensors and/or vehicles in order to increase coverage, enhance the end-to-end delay, and improve data processing. While UAV-aided networks can potentially find applications in many areas, a number of issues, particularly security, have not been readily addressed. The intrusion detection system is the most commonly used technique to detect attackers. In this paper, we focus on addressing two main issues within the context of intrusion detection and attacker ejection in UAV-aided networks, namely, activation of the intrusion monitoring process and attacker ejection. In fact, when a large number of nodes activate their monitoring processes, the incurred overhead can be substantial and, as a consequence, degrades the network performance. Therefore, a tradeoff between the intrusion detection rate and overhead is considered in this work. It is not always the best strategy to eject a node immediately when it exhibits a bad sign of malicious activities since this sign could be provisional (the node may switch to a normal behavior in the future) or be simply due to noise or unreliable communications. Thus, a dilemma between detection and false positive rates is taken into account in this paper. We propose to address these two security issues by a Bayesian game model in order to accurately detect attacks (i.e., high detection and low false positive rates) with a low overhead. Simulation results have demonstrated that our proposed security game framework does achieve reliable detection.

Intrusion detection systems (IDS) are widely applied to computer networks and systems as an information security control. Most of the current IDS work by detecting patterns of behavior of previously known attacks (attack signature). One drawback of signature based IDS is that they are vulnerable to previously unknown attacks. As an alternative, anomaly based IDS use a model of what is considered a normal behavior of a computer system or network and then they could detect any attack, know or unknown. The main problem of this approach is to find an adequate model of normality. In this paper, we present a method to build a model of behavior of computer network and systems. In this model a set of fuzzy organizational states are deduced from time series of computer resources utilization applying the discrete fuzzy transform.

이 논문에서는 침입 탐지 시스템의 탐지 효율을 높이기 위해 데이터 마이닝의 클러스터링 기법을 이용하여 경보 데이터를 그룹화하고 그 결과를 이용하여 경보 데이터의 상관 관계를 분석하는 방법을 제안하였다. 즉 클러스터링 기법을 이용하여 경보데이터를 사용자가 원하는 개수의 그룹으로 분류하고, 생성된 경보 데이터 클러스터 모델을 이용하여 새로운 경보 데이터을 분류할 수 있도록 하였다. 또한, 결과 클러스터의 생성 원인이 되는 이전의 경보의 분포 데이터를 저장 관리하여 클러스터 간의 시퀀스를 생성하였고, 생성된 각각의 클러스터 시퀀스를 통합하여 클러스터들의 시퀀스를 추출하여 발생한 경보 이후의 향후 발생 가능한 경보 타입을 예측하기 위한방법을 제공하였다. 이는 과거에 탐지된 공격의 형태 뿐만 아니라 새로운 혹은 변형된 경보의 분류나 분석에도 이용 가능하다. 또한 생성된 클러스터간의 생성 원인의 분석에 의한 클러스터 간의 순차적인 관계의 추출을 통해 사용자가 공격의 순차적 구조나 탐지된 각 공격 이면에 감추어진 전략을 이해하는데 도움을 주며 현재의 경보 이후에 발생 가능한 경보들을 얘측할 수 있다. In this paper, we propose an approach to correlate alerts using a clustering analysis of data mining techniques in order to support intrusion detection system. Intrusion detection techniques are still far from perfect. Current intrusion detection systems cannot fully detect novel attacks. However, intrucsion detection techniques are still far from perfect. Current intrusion detection systems cannot fully detect novel attacks or variations of known attacks without generating a large amount of false alerts. In addition, all the current intrusion detection systems focus on low-level attacks or anomalies. Consequently, the intrusion detection systems to underatand the intrusion behind the alerts and take appropriate actions. The clustering analysis groups data objects into clusters such that objects belonging to the same cluster are similar, while those belonging to different ones are dissimilar. As using clustering technique, we can analyze alert data efficiently and extract high-level knowledgy about attacks. Namely, it is possible to classify new type of alert as well as existed. And it helps to understand logical steps and strategies behind series of attacks using sequences of clusters, and can potentially be applied to predict attacks in progress.

This paper is going to present a hybrid model for IDS using ANN and data mining approaches. it is important to deploy a hybrid network using ANN based and data mining based IDS systems that can enable the system in making decisions on intrusion in a mobile environment. MANET is an infrastructure-less ad-hoc network. It is a collection of mobile nodes that are connected in an arbitrary and dynamic manner. ANN (Artificial Neural Network) is a type of Machine Learning scientific and statistical model that is used by computer systems in order to perform a task without involvement of explicit intrusion, rather than relying on interference and patterns instead. As there is node mobility that can impose different security issues, MANETs are found more susceptible in security provision. In order to resolve this security issue, some authentication and encryption techniques can be proposed for the first-line defensein order to mitigate the security risks. However, complete eradication of these types of risks is next to impossible. For theSecond line defense, the necessity of an Intrusion Detection System (IDS) is essential in this case. IDS can be referred as a method tool or resource that can help to detect access and warn for any activity of unapproved or unauthorized network activity. The current research has been done to prevent the network from the intruders. The number of attackers has been increased in the network because of more usage of technology and wireless network. Data is not allowed by the attackers to transmit successfully from source node to destination node. These intruders want to steal data and let to the unsuccessful transmission. In this research we are deploying 48 to 66 nodes in a defined communication area of 1000*1000 height and width. While starting the transmission source node and destination node is defined. After that while using IDS and AODV protocol route is created between destination and source node. If network decreases its performance will need to apply cuckoo search as an optimization algorithm. Cuckoo search algorithm extracts the properties and observe the energy been consumed by each node. Optimized properties provided as an input to the decision tree classifier with the help of this, system is being prepared according to their properties. If there will be a chance for existence of intruder in the network then it will be classified using decision tree algorithm. At the end QOS parameters energy consumption is performed using cuckoo search optimization algorithm. The detected intruder is prevented using decision tree and removed from the MANET network.