Intelligent Autoencoder with LSTM based Intrusion Detection and Recommender System

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

Intrusion detection in Industrial Internet of Things (IIoT) systems is critical for protecting essential infrastructure from cyber threats. This paper introduces a novel multistage optimization framework designed to enhance intrusion detection accuracy. The first stage employs a Hybrid ACO-GA/PSO algorithm for feature selection, ensuring the retention of the most relevant features to improve classification precision. In the second stage, Long Short Term Memory (LSTM) networks are optimized using a combination of the Bat Algorithm and the Whale Optimization Algorithm, enabling precise fine-tuning of hyper-parameters to maximize model performance. A Generative Adversarial Network (GAN) is incorporated in the final evaluation stage, testing the model's robustness against previously unseen data, followed by training the generated data on the optimized LSTM model. To further interpret and explain the results, we apply Explainable AI (XAI) techniques, including SHAP and LIME, providing insight into feature importance and model decision-making. Our approach is evaluated with standard performance metrics, demonstrating significant improvements in detection accuracy and validating the efficacy of our hybrid framework for advancing IIoT security mechanisms. Highlights Multi-Stage Optimization Framework Hybrid Feature Selection Fine-tuned LSTM Model GAN for Robustness Testing Explainable AI (XAI) Integration

The rapid growth of the internet and digital communication, network security has become a critical concern. Traditional Intrusion Detection Systems (IDS), especially rule-based or signature-based systems, are effective only against known attacks [1], [2]. However, they fail to detect novel or zero-day threats because they rely on predefined signatures [5], [7]. To overcome this limitation, anomaly detection techniques have gained importance. Anomaly-based systems monitor network traffic and identify deviations from normal behavior, which could indicate potential cyber-attacks [6]. This project focuses on Network Anomaly Detection using Deep Learning techniques [3]. The proposed system leverages models such as Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), or Long Short-Term Memory (LSTM) networks to learn patterns of normal network traffic and accurately identify abnormal or malicious activities [4], [5]. Deep learning models are capable of handling large-scale, high-dimensional data, and can automatically extract complex features without manual intervention [3], [6]. The objective of this work is to design a robust, intelligent intrusion detection framework that can not only detect known threats but also adapt to new and evolving attack patterns. The system will be trained and validated using benchmark datasets like NSL-KDD or CICIDS2017 [1], [2]. Performance will be measured using metrics such as accuracy, precision, recall, and F1-score. By implementing deep learning-based anomaly detection, this project aims to enhance the efficiency of network security, minimize false positives, and provide a scalable solution for real-time intrusion detection in modern networks [5], [6], [7].

Intrusion Detection Systems (IDS) are integral to ensuring network security. However, in practical settings, network traffic data often exhibits significant imbalances, affecting both labeled and unlabeled data distributions. Such imbalances notably degrade the performance of existing intrusion detection methods, particularly in semi-supervised learning contexts, where traditional approaches struggle to effectively leverage large amounts of unlabeled data for enhanced detection capabilities. This paper introduces a semi-supervised learning approach based on normalizing flows to mitigate the data imbalance issue in network intrusion detection. Normalizing flows construct flexible and invertible probabilistic models that can accurately capture and generate complex, highdimensional network traffic data distributions. Specifically, this method utilizes a small amount of labeled data for initial training and incorporates manifold learning and self-training with unlabeled data to adapt the model to the imbalance in the unlabeled data distribution, thereby improving overall detection performance. Experimental results demonstrate that this method outperforms traditional approaches in addressing data imbalance in intrusion detection. The proposed method not only improves detection accuracy and recall but also significantly reduces reliance on data distribution assumptions, demonstrating robustness and generalization across diverse network traffic datasets.

Due to the recent advances in the Internet and communication technologies, network systems and data have evolved rapidly. The emergence of new attacks jeopardizes network security and make it really challenging to detect intrusions. Multiple network attacks by an intruder are unavoidable. Our research targets the critical issue of class imbalance in intrusion detection, a reflection of the real-world scenario where legitimate network activities significantly out number malicious ones. This imbalance can adversely affect the learning process of predictive models, often resulting in high false-negative rates, a major concern in Intrusion Detection Systems (IDS). By focusing on datasets with this imbalance, we aim to develop and refine advanced algorithms and techniques, such as anomaly detection, cost-sensitive learning, and oversampling methods, to effectively handle such disparities. The primary goal is to create models that are highly sensitive to intrusions while minimizing false alarms, an essential aspect of effective IDS. This approach is not only practical for real-world applications but also enhances the theoretical understanding of managing class imbalance in machine learning. Our research, by addressing these significant challenges, is positioned to make substantial contributions to cybersecurity, providing valuable insights and applicable solutions in the fight against digital threats and ensuring robustness and relevance in IDS development. An intrusion detection system (IDS) checks network traffic for security, availability, and being non-shared. Despite the efforts of many researchers, contemporary IDSs still need to further improve detection accuracy, reduce false alarms, and detect new intrusions. The mean convolutional layer (MCL), feature-weighted attention (FWA) learning, a bidirectional long short-term memory (BILSTM) network, and the random forest algorithm are all parts of our unique hybrid model called MCL-FWA-BILSTM. The CNN-MCL layer for feature extraction receives data after preprocessing. After convolution, pooling, and flattening phases, feature vectors are obtained. The BI-LSTM and self-attention feature weights are used in the suggested method to mitigate the effects of class imbalance. The attention layer and the BI-LSTM features are concatenated to create mapped features before feeding them to the random forest algorithm for classification. Our methodology and model performance were validated using NSL-KDD and UNSW-NB-15, two widely available IDS datasets. The suggested model's accuracies on binary and multi-class classification tasks using the NSL-KDD dataset are 99.67% and 99.88%, respectively. The model's binary and multi-class classification accuracies on the UNSW-NB15 dataset are 99.56% and 99.45%, respectively. Further, we compared the suggested approach with other previous machine learning and deep learning models and found it to outperform them in detection rate, FPR, and F-score. For both binary and multiclass classifications, the proposed method reduces false positives while increasing the number of true positives. The model proficiently identifies diverse network intrusions on computer networks and accomplishes its intended purpose. The suggested model will be helpful in a variety of network security research fields and applications.

Cyber-Physical Systems (CPS) are increasingly deployed across sectors such as energy, manufacturing, and healthcare, where real-time monitoring and secure operations are essential. As these systems become targets for sophisticated cyber threats, the need for accurate, low-latency intrusion detection has become critical. While many studies have proposed AI-based solutions for securing CPS, there remains a lack of systematic benchmarking across diverse datasets and attack scenarios.This paper presents a dataset-driven benchmarking study of machine learning and deep learning-based Intrusion Detection Systems (IDS) tailored for CPS environments. Using publicly available CPS-related datasets—including UNSW-NB15, CICIDS2017, BATADAL, and the ICS-Cyber Attack Dataset—we evaluate the performance of Support Vector Machines (SVM), Random Forest (RF), Long Short-Term Memory (LSTM) networks, and a proposed Hybrid AI model. Evaluation metrics include accuracy, precision, recall, F1-score, and false positive rate, providing a holistic view of each model's effectiveness. Results indicate that while traditional models like RF and SVM offer faster inference times, deep learning models such as LSTM consistently outperform in terms of detection accuracy and false positive reduction. The Hybrid AI model demonstrates a balanced trade-off between performance and efficiency, making it a promising approach for real-world CPS deployments. This benchmarking effort serves as a foundation for selecting and optimizing IDS solutions in CPS, highlighting the importance of aligning detection models with dataset characteristics and operational constraints.

With the rapid expansion of network-based applications, intrusion detection systems (IDS) have become essential for safeguarding sensitive data and ensuring system reliability. However, traditional IDS models often face challenges related to high computational cost and energy consumption, especially in resource-constrained environments. This paper presents a comprehensive review of energy-efficient IDS approaches based on machine learning and deep learning techniques. It covers various methods, including CNN, LSTM, auto encoders, optimization algorithms, and hybrid models, highlighting how they improve detection accuracy while reducing computational overhead. The review also analyzes datasets, performance metrics, and energy optimization strategies such as pruning, quantization, and knowledge distillation. By categorizing existing research and identifying gaps, this work aims to provide insights into designing scalable, low-latency, and energy-aware IDS solutions for modern networks. The findings serve as a foundation for future advancements in sustainable and intelligent cyber security systems.

The purpose of a Network Intrusion Detection System is to detect intrusive, malicious activities or policy violations in a host or host’s network. In current networks, such systems are becoming more important as the number and variety of attacks increase along with the volume and sensitiveness of the information exchanged. This is of particular interest to Internet of Things networks, where an intrusion detection system will be critical as its economic importance continues to grow, making it the focus of future intrusion attacks. In this work, we propose a new network intrusion detection method that is appropriate for an Internet of Things network. The proposed method is based on a conditional variational autoencoder with a specific architecture that integrates the intrusion labels inside the decoder layers. The proposed method is less complex than other unsupervised methods based on a variational autoencoder and it provides better classification results than other familiar classifiers. More important, the method can perform feature reconstruction, that is, it is able to recover missing features from incomplete training datasets. We demonstrate that the reconstruction accuracy is very high, even for categorical features with a high number of distinct values. This work is unique in the network intrusion detection field, presenting the first application of a conditional variational autoencoder and providing the first algorithm to perform feature recovery.

Security of networks is becoming progressively more necessary as the commercial internet keeps on developing. Intrusion detection techniques using network data have emerged as a significant area of investigation among the various network protection solutions. Many techniques for detecting network anomalies were suggested up to this point. A substantial amount of labeled data is needed for modeling in Machine Learning (ML) that constitutes the basis of the majority of more effective performance detection strategies. Nevertheless, manually filtering and labeling large-scale traffic data is not feasible in a real network. For real detection, network managers can only employ unsupervised ML techniques and the results of such strategies are far less accurate than those of supervised ML strategies. To increase network security’s efficiency of processing, adaptability, and specificity of detection, this method is useful for instantaneous, network-based safety applications because it maximizes intrusion detection accuracy across several attack types by utilizing quantum computer technology. This paper suggests an innovative multiclassification fusion strategy for optimizing network intrusion detection performance. Numerous fusion approaches are used in this research to combine the identification outcomes of effective intrusion detection approaches. A variety of publicly available KDD Cup 99 datasets were utilized for comparative investigations. According to the experiments, the suggested fusion approach [Decision Tree, K-Nearest Neighbor (KNN), improved Siam Intrusion Detection System (I-SiamIDS), Long Short-Term Memory (LSTM)] outperforms individual intrusion detection techniques in multiple measurements. It also exhibits enhanced resilience and stability, making it suitable for use in a variety of network-based safety recognition settings. The study uses the four primary classes of attacks such as Remote-to-Local (R2L), User to Root (U2R), Denial of Service (DoS), and Probing (Probe), which were compared with the performance metrics such as Precision, F-score, Accuracy, and Recall.

SummaryCloud's operating‐system‐level virtualization has introduced a new phase of lightweight virtualization through containers. The architecture of cloud‐native and microservices‐based application development strongly advocates for the use of containers due to their swift and convenient deployment capabilities. However, the security of applications within containers is important, as malicious or vulnerable content could jeopardize the container and the host system. This vulnerability also extends to neighboring containers and may compromise data integrity and confidentiality. The article focuses on developing an intrusion detection system tailored to containerized cloud environments by identifying system call analysis techniques and also proposes an anomaly‐based host intrusion detection system (Ab‐HIDS). This system employs the frequency of N‐grams system calls as distinctive features. To enhance performance, two ensemble learning models, namely voting‐based ensemble learning and XGBoost ensemble learning, are employed for training and testing the data. The proposed system is evaluated using the Leipzig Intrusion Detection Data Set (LID‐DS), demonstrating substantial performance compared to existing state‐of‐the‐art methods. Ab‐HIDS is validated for class imbalance using the imbalance ratio and synthetic minority over‐sampling technique methods. Our system achieved significant improvements in detection accuracy with 4% increase for the voting‐based ensemble model and 6% increase for the XGBoost ensemble model. Additionally, we observed reductions in the false positive rate by 0.9% and 0.8% for these models, respectively, compared to existing state‐of‐the‐art methods. These results illustrate the potential of our proposed approach in improving security measures within containerized environments.

With the development of 5G technology, internet traffic has surged dramatically, presenting severe challenges to cybersecurity. Considering that network traffic exhibits temporal correlation, it can be used as a basis for identifying network attacks. In this paper, a joint framework of network traffic interpolation and intrusion detection is proposed. First, by leveraging historical network traffic, traffic characteristics can be obtained, allowing for preemptive prevention of network attacks. To obtain network features at equal time intervals, the Lagrange interpolation method is introduced. Second, a deep learning algorithm combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) Networks is proposed to extract spatiotemporal features from network traffic, distinguishing between normal and abnormal network activities. Experimental results based on real network traffic dataset show that the intrusion detection accuracy using CNN and LSTM can reach above 90%, which shows that the proposal can achieve reliable intrusion detection to defend against cyber attacks.

Software-Defined Networking (SDN) promises flexible control of network flows but also exposes controllers to rapidly shifting attack surfaces. Conventional intrusion-detection engines, trained once and deployed statically, falter when traffic patterns drift. We introduce an adaptive intrusion detection system that couples a mini-batch incremental learning scheme with a five-member ensemble of Long Short-Term Memory (LSTM) classifiers. Each model trains on successive data partitions drawn from the InSDN dataset, while a lightweight tracker monitors accuracy and “age.” A weighted-voting rule penalizing stale models in proportion to their lifetime lets the ensemble down-rank obsolete learners without full retraining. When the tracker flags slippage, only the most dated models are refreshed, limiting computational load and preserving service continuity. Across four streaming iterations, the system sustains a mean detection accuracy of 95.8% and a 3.2% false-positive rate, recovering quickly from concept drift that drives individual models to baseline performance. Comparative analysis against three recent SDN IDS baselines shows improvements of up to 14 percentage points in accuracy and 0.48 in F-score, without sacrificing latency (≈50 ms). These results indicate that modest, well-timed retraining rather than continual online updates can keep an SDN IDS both nimble and efficient. The approach offers a practical roadmap for securing programmable networks that evolve by the hour.

An intrusion detection system (IDS) is a device or software application that monitors a network for malicious activity or policy violations. It scans a network or a system for a harmful activity or security breaching. IDS protects networks (Network-based intrusion detection system NIDS) or hosts (Host-based intrusion detection system HIDS), and work by either looking for signatures of known attacks or deviations from normal activity. Deep learning algorithms proved their effectiveness in intrusion detection compared to other machine learning methods. In this paper, we implemented deep learning solutions for detecting attacks based on Long Short-Term Memory (LSTM). PCA (principal component analysis) and Mutual information (MI) are used as dimensionality reduction and feature selection techniques. Our approach was tested on a benchmark data set, KDD99, and the experimental outcomes show that models based on PCA achieve the best accuracy for training and testing, in both binary and multiclass classification.

The rapid advancement of cyber threats necessitates the development of more sophisticated intrusion detection systems (IDS). Traditional IDS methods of- ten fail to keep up with the evolving nature of these threats. This paper explores the use of adaptive ma- chine learning algorithms to enhance IDS performance in cybersecurity. By utilizing adaptive learning techniques, we aim to create a system that dynamically adjusts to new and emerging threats in real-time. We evaluate several machine learning algorithms, including decision trees, support vector machines, neural networks, and ensemble methods, to determine their effectiveness in intrusion detection. Our pro- posed framework integrates these algorithms into an adaptive system that continuously improves its detection accuracy and reduces false positives by learning from ongoing threat patterns. Experiments conducted on benchmark datasets re- veal that our adaptive IDS framework outperforms traditional methods, demonstrating significant improvements in detection accuracy and response time. This research highlights the potential of adaptive ma- chine learning algorithms to provide a more robust and intelligent defence against cyber threats, paving the way for next-generation intrusion detection systems.

In this article, an EFS-LSTM, a deep recurrent learning model, is proposed for network intrusion detection systems. The EFS-LSTM model uses ensemble-based feature selection (EFS) and LSTM (Long Short Term Memory) for the classification of network intrusions. The EFS combines five feature selection mechanisms namely, information gain, gain ratio, chi-square, correlation-based feature selection, and symmetric uncertainty-based feature selection. The experiments were conducted using the benchmark NSL-KDD dataset and implemented using Tensor flow and python. The EFS-LSTM classifier is evaluated using the classification performance metrics and also compared with all the 41 features without any feature selection as well as with each individual feature selection techniques and classified using LSTM. The performance study showed that the EFS-LSTM model outperforms better with 99.8% accuracy with a higher detection and less false alarm rates.