Improving the efficiency of intrusion detection in information systems

Intrusion Detection (ID) is essential for protecting contemporary computer networks from a range of threats. Modern ID techniques must cope with increasingly sophisticated attacks as well as rapidly rising network line speeds. Signature based ID is forced to sample sparsely, increasing the likelihood of malicious traffic entering the network without scrutiny. Con sequently, flow-based ID is gaining attention as an effective complement. ID systems are furthermore often characterized as either network-based or host-based. The autonomous multi agent design paradigm is a scalable, attractive alternative for its potential to leverage the strengths of both architectures: the broad perspective and visibility into distributed malicious activity provided by network-based ID, and the comprehensive view of the local node provided by host-based ID. This paper therefore develops an architecture for a new multi agent, flow-based intrusion detection sysem. The architecture is designed in two iterations of increasing complexity. These innovative ID designs use a "repuation" system to permit agents to dynamically find nodes that are most effective for classifying malicious network activity. Furthermore, each system design includes the development of an innovative classifier that uses multi objective evolutionary algorithms to aid in the search for effective operational parameter values. Evaluation using an extensive agent simulation framework highlights the conditions under which the reputation system provides a significant classification benefit.

The rising integration of IoT devices into various applications has amplified security risks, particularly in resource-limited setups with constrained computing capacity and storage. Standard intrusion detection approaches often prove inadequate for these contexts owing to their intensive resource needs. This work proposes a host-based intrusion detection system customized for IoT infrastructures, harnessing compact and adaptable machine learning strategies. The developed system examines diverse classifier groups, encompassing tree-oriented models like Decision Tree and Random Forest, boosting-oriented techniques such as LightGBM and XGBoost, support vector machines including LinearSVC, and linear-based classifiers encompassing Logistic Regression, Stochastic Gradient Descent, Passive-Aggressive methods, and Perceptron algorithms. To identify the optimal detection algorithms suited to varied IoT application environments, a multi-factor decision framework integrating TOPSIS, VIKOR, MOORA, and WASPAS ranking methodologies is utilized. Outcomes from trials reveal that linear classifiers and streamlined tree models deliver strong detection performance alongside brief training periods and lowered processing demands.The solution achieves a top accuracy rate of 98.7%, with training times under two seconds for the majority of algorithms, yielding roughly 15-20 times enhancement in efficiency relative to typical ensemble-driven intrusion detection systems.

The smart grid is vulnerable to network attacks, thus requiring a high detection rate and fast detection speed for intrusion detection systems. With a fast training speed and a strong model generalization ability, the extreme learning machine (ELM) perfectly meets the needs of intrusion detection of the smart grid. In this paper, the ELM is applied to the field of smart grid intrusion detection. Aiming at the problem that the randomness of input weights and hidden layer bias in the ELM cannot guarantee the optimal performance of the ELM intrusion detection model, a genetic algorithm (GA)-ELM algorithm based on a genetic algorithm (GA) is proposed. GA is used to optimize the input weight and hidden layer bias of the ELM. Firstly, the input weight and hidden layer bias of the ELM are mapped to the chromosome vector of a GA, and the test error of the ELM model is set as the fitness function of the GA. Then, the parameters of the ELM intrusion detection model are optimized by genetic operation; the input weight and bias, corresponding to the minimum test error, are selected to improve the performance of the ELM model. Compared with the ELM and online sequential extreme learning machine (OS-ELM), the GA-ELM effectively improves the accuracy, detection rate and precision of intrusion detection and reduces the false positive rate and missing report rate.

An efficient intrusion detection system based on hypergraph - Genetic algorithm for parameter optimization and feature selection in support vector machine

Cybersecurity has become an important part of our daily lives. As an important part, there are many researches on intrusion detection based on host system call in recent years. Compared to sentences, a sequence of system calls has unique characteristics. It contains implicit pattern relationships that are less sensitive to the order of occurrence and that have less impact on the classification results when the frequency of system calls varies slightly. There are also various properties such as resource consumption, execution time, predefined rules, and empirical weights of system calls. Commonly used word embedding methods, such as Bow, TI-IDF, N-Gram, and Word2Vec, do not fully exploit such relationships in sequences as well as conveniently support attribute expansion. To solve these problems, we introduce Graph Representation based Intrusion Detection (GRID), an intrusion detection framework based on graph representation learning. It captures the potential relationships between system calls to learn better features, and it is applicable to a wide range of back-end classifiers. GRID utilizes a new sequence embedding method Graph Random State Embedding (GRSE) that uses graph structures to model a finite number of sequence items and represent the structural association relationships between them. A more efficient representation of sequence embeddings is generated by random walks, word embeddings, and graph pooling. Moreover, it can be easily extended to sequences with attributes. Our experimental results on the AFDA-LD dataset show that GRID has an average improvement of 2% using the GRSE embedding method comparing to others.

In this work, a Behaviour-based Intrusion Detection Model is suggested. The proposed model can be employed from a single host configuration to a distributed mixture of host-based and network-based Intrusion Detection Systems (IDSs). Unlike most state-of-the-art IDSs that rely on analysing lower-level, raw-data representations, our proposed architecture suggests to use higher-level notions -behaviours- instead; this way, the IDS is able to identify more sophisticated attacks. To assess our premise, a Behaviour-based IDS (BIDS) prototype has been designed and developed that scans file system data to identify attacks. BIDS achieves high detection rates with low corresponding false positive rates, superseding other state-of-the-art file system IDSs.

The accelerated digital transformation of the banking sector has enhanced the delivery of financial services but simultaneously expanded the cyberattack surface, exposing institutions to advanced persistent threat (APT), zero-day exploit, and obfuscated malware. Conventional perimeter defenses, primarily Layer 3 and 4 firewalls and signature-based intrusion detection systems (IDS), offer insufficient protection against encrypted, evasive, and previously unknown cyberattacks, and frequently generate high false-positive rates that burden Security Operations Center (SOC). This study proposes a multilayered adaptive cybersecurity framework that integrates Layer 7 Next Generation Firewall (NGFW), hybrid Network and Host-based Intrusion Detection and Prevention System (NIDPS/HIDPS), and an AI-driven analysis engine. The framework employs a dual-stage detection architecture, combining Convolutional Neural Network (CNN) for spatial representation learning and Random Forest (RF) classifiers for anomaly decisioning. The model was evaluated using a strategically consolidated dataset derived from CIC-IDS-2017 and UNSW-NB15, specifically isolating cyberattack vectors prevalent in financial infrastructures (e.g., SQL Injection, DDoS, and Brute Force). The model achieves 99.65% detection accuracy and a reduced false-positive rate of 0.35%, significantly outperforming classical SVM and standalone signature-based systems. The results demonstrate that the proposed architecture aligned with NIST and PCI-DSS standard as well as defense-in-depth mechanism suitable for real-time, high-frequency financial environments.

Due to our increased dependence on Internet and growing number of intrusion incidents, building effective intrusion detection systems are essential for protecting Internet resources and yet it is a great challenge. In literature, many researchers utilized Artificial Neural Networks (ANN) in supervised learning based intrusion detection successfully. Here, ANN maps the network traffic into predefined classes i.e. normal or specific attack type based upon training from label dataset. However, for ANN-based IDS, detection rate (DR) and false positive rate (FPR) are still needed to be improved. In this study, we propose an ensemble approach, called MANNE, for ANN-based IDS that evolves ANNs by Multi Objective Genetic algorithm to solve the problem. It helps IDS to achieve high DR, less FPR and in turn high intrusion detection capability. The procedure of MANNE is as follows: firstly, a Pareto front consisting of a set of non-dominated ANN solutions is created using MOGA, which formulates the base classifiers. Subsequently, based upon this pool of non-dominated ANN solutions as base classifiers, another Pareto front consisting of a set of non-dominated ensembles is created which exhibits classification tradeoffs. Finally, prediction aggregation is done to get final ensemble prediction from predictions of base classifiers. Experimental results on the KDD CUP 1999 dataset show that our proposed ensemble approach, MANNE, outperforms ANN trained by Back Propagation and its ensembles using bagging & boosting methods in terms of defined performance metrics. We also compared our approach with other well-known methods such as decision tree and its ensembles using bagging & boosting methods.

Intrusion detection is an important technique in computer and network security. A variety of intrusion detection approaches be present to resolve this severe issue but the main problem is performance. It is important to increase the detection rates and reduce false alarm rates in the area of intrusion detection. Therefore, in this research, an optimized intrusion detection mechanism using soft computing techniques is proposed to overcome performance issues. The KDD-cup dataset is used that is a benchmark for evaluating the security detection mechanisms. The Principal Component Analysis (PCA) is applied to transform the input samples into a new feature space. The selecting of an appropriate number of principal components is a critical problem. So, Genetic Algorithm (GA) is used in the optimum selection of principal components instead of using traditional method. The Support Vector Machine (SVM) is used for classification purpose. The performance of this approach is addresses. Further, a comparative analysis is made with existing approaches. Consequently, this method provides optimal intrusion detection mechanism which is capable to minimize amount of features and maximize the detection rates.

In recent years, with increasing use of internet the computer systems are facing many number of security issues. Intrusion detection system (IDS) is one of the principal components of any information security system. Identification of anomalous activity in computer network is first step in identifying the threat to information system. Our focus is mainly on Genetic algorithm (GA) based anomaly detection technique, as GA is one of the most effective evolutionary techniques for machine learning. In this paper Genetic algorithm is applied for network intrusion detection. Our approach for optimization specifically focusing on false positive rate. Reduction in false positive rate also improves accuracy and performance. The limitation of other techniques of accuracy, false positive rates has been addressed in this paper. Experimental results show the efficient detection rates based on KDD99cup datasets which is a standard dataset for intrusion detection.

: Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. One alternative to NIDSs, host-based intrusion detection systems (HIDSs), provides some of the functionality of NIDSs but with limitations. HIDSs cannot perform a network-wide analysis and can be subverted if a host is compromised. We propose an approach to intrusion detection that combines HIDS, NIDS, and a version of IPsec that encrypts the header and the body of IP packets separately. We refer to the latter generically as TwoKey IPsec. We show that all of the network events currently detectable by the Snort NIDS on un- encrypted network traffic are also detectable on encrypted network traffic using this approach. The NIDS detects network-level events that HIDSs have trouble detecting and HIDSs detect application-level events that can't be detected by the NIDS.

Chapter 5 - Intrusion Prevention and Detection Systems

To improve the efficiency of Internet intrusion detection, data mining is adopted in intrusion detection. The paper introduces the concept of intrusion detection and k-means algorithm. For the defect of K-means algorithm, it proposes an improved K-means algorithm. Experiments show that the improved k-means algorithm can get a better detection rate.

Anomaly intrusion detection normally has high false alarm rates, and a high volume of false alarms will prevent system administrators identifying the real attacks. Machine learning methods provide an effective way to decrease the false alarm rate and improve the detection rate of anomaly intrusion detection. In this research, we propose a novel approach using kernel methods and Support Vector Machine (SVM) for improving anomaly intrusion detectors' accuracy. Two kernels, STIDE kernel and Markov Chain kernel, are developed specially for intrusion detection applications. The experiments show the STIDE and Markov Chain kernel based two class SVM anomaly detectors have better accuracy rate than the original STIDE and Markov Chain anomaly detectors. Generally, anomaly intrusion detection approaches build normal profiles from labeled training data. However, labeled training data for intrusion detection is expensive and not easy to obtain. We propose an anomaly detection approach, using STIDE kernel and Markov Chain kernel based one class SVM, that does not need labeled training data. To further increase the detection rate and lower the false alarm rate, an approach of integrating specification based intrusion detection with anomaly intrusion detection is also proposed. This research also establish a platform which generates automatically both misuse and anomaly intrusion detection software agents. In our method, a SIFT representing an intrusion is automatically converted to a Colored Petri Net (CPNs) representing an intrusion detection template, subsequently, the CPN is compiled into code for misuse intrusion detection software agents using a compiler and dynamically loaded and launched for misuse intrusion detection. On the other hand, a model representing a normal profile is automatically generated from training data, subsequently, an anomaly intrusion detection agent which carries this model is generated and launched for anomaly intrusion detection. By engaging both misuse and anomaly intrusion detection agents, our system can detect known attacks as well as novel unknown attacks.

Wireless Body Area Network (WBAN) is a pioneer trend in healthcare technology.A WBAN consists of small sensors that may be worn or implanted on the patient's body or around them.These sensors are responsible for sending wireless, real-time physiological signs of the patient's body (such as blood pressure, heart rate, blood sugar, temperature, breathing, etc.) to an intermediate device.An intermediate device (such as a mobile phone) collects and prepares data to send and display to the doctor.In the WBAN, since data is sent through all broadcasts, any cyber attack such as eavesdropping and data modification/ sabotage can be done.Any cyber-attack on a WBAN could jeopardize the patient's health; therefore, securing the WBAN plays a crucial role in healthcare applications.Due to the limitation of energy, memory, and processing power of sensors in WBAN, it is not possible to use traditional security methods, such as encryption and security protocols.For this reason, one of the methods to provid security in the WBAN is the use of intrusion detection systems.An intrusion detection system (IDS), as a second-line defense, is one of the security methods in computer networks.Intrusion detection is the intelligent monitoring of network or computer systems to find any security breach.These systems are divided into two groups, signature-based and anomaly-based.One of the advantages 1 55 160 of anomaly-based systems is the detection of zero-day attacks.Statistical, knowledge-based, data mining and machine learning methods can be used to implement anomaly-based intrusion detection systems.In this paper, a new IDS has been presented which is able to detect denial of service (DoS) attacks in a WBAN.The proposed IDS is a hybrid anomaly-based system using machine learning and feature engineering methods.In the proposed IDS, a genetic algorithm is used to select features of collected data, in a way that increases the performance of the IDS, and as a result the WBAN (increasing detection rate and reducing energy consumption in the node).Then, using support vector machine and k nearest neighbor algorithms, the data classification is performed to detect DoS traffic from regular data traffic.Simulation results indicate that the proposed IDS has effective performance with a 90% detection rate.