Intelligent Intrusion Detection System With Autonomous Optimal Traffic Steering for Aerial-Aided Edge Computing

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

Nowadays, cyber-attacks are beginning to be smart and hard to be detected, these attacks can be classified as Advance Persistence Threat(APT), which are hard to be detected and need sophisticated mechanisms of cybersecurity detection systems to be implemented to detect these types of attacks. Snort is an Intrusion Detection System (IDS) open source application that gained a high level of trust from hundreds of companies by using it as an IDS sensor whether Host-based Intrusion Detection System (HIDS) or Network Intrusion Detection System (NIDS) mode. Snort is depending on rules that are predefined to detect known attacks where if there is a new attack released and have not been registered to CheckPoint as an attack, then Snort will not detect it as an attack and the attack will bypass. The main problem that stands with traditional IDS (Snort) is the rate of false positive alerts. A new technique has been revealed by understanding the behavior of the traffic flow and deciding if the traffic flow matches the attributes that have abnormal activities that the traditional misuse IDS cannot detect. The new technique is a machine learning process that depending on training and testing the data of the traffic after converting the PCAP file to CSV file through an application that calls CICFlowMeter. it is an open source machine learning application that used as GUI mode calls Weka. After the PCAP file converted through CICFlowMeter, a dataset end with CSV extension will be generated with 80 plus attributes that Weka will learn as the training phase after that the testing phase will determine the matched traffic if they are normal or abnormal.

With the rapid development of information technology, network security issues have become increasingly prominent. In particular, data security intrusions pose serious threats to the data privacy and system security of enterprises and individuals. Traditional intrusion detection systems often exhibit low detection accuracy and high false alarm rates when faced with complex and dynamic network environments and diverse attack methods. Therefore, this paper proposes a data security intrusion detection system based on deep learning, which integrates the Mamba model and ECANet model and employs an end-to-end learning approach for training and optimization. First, the Mamba model is introduced for preliminary data feature extraction, whose efficient feature representation capabilities provide a solid foundation for the subsequent detection process. Then, by integrating the ECANet model, feature selection is further optimized through the attention mechanism, enhancing the model’s focus on important features. Finally, an end-to-end learning approach is adopted to train and optimize the entire system, ensuring excellent performance and robustness in practical applications. Experimental results show that the proposed intrusion detection system demonstrates higher detection accuracy on multiple test datasets, improving by approximately 5% compared to traditional methods, providing a new and effective solution for data security.

Attack-aware Security Function Management

As 5G and beyond networks grow in heterogeneity, complexity, and scale, traditional Intrusion Detection Systems (IDS) struggle to maintain accurate and precise detection mechanisms. A promising alternative approach to this problem has involved the use of Deep Learning (DL) techniques; however, DL-based IDS suffer from issues relating to interpretation, performance variability, and high computational overheads. These issues limit their practical deployment in real-world applications. In this study, CiNeT is introduced as a novel DL-based IDS employing Convolutional Neural Networks (CNN) within a bijective encoding–decoding framework between network traffic features (such as IPv6, IPv4, Timestamp, MAC addresses, and network data) and their RGB representations. This transformation facilitates our DL IDS in detecting spatial patterns without sacrificing fidelity. The bijective pipeline enables complete traceability from detection decisions to their corresponding network traffic features, enabling a significant initiative towards solving the ‘black-box’ problem inherent in Deep Learning models, thus facilitating digital forensics. Finally, the DL IDS has been evaluated on three datasets, UNSW NB-15, InSDN, and ToN_IoT, with analysis conducted on accuracy, GPU usage, memory utilisation, training, testing, and validation time. To summarise, this study presents a new CNN-based IDS with an end-to-end pipeline between network traffic data and their RGB representation, which offers high performance and enhanced interpretability through revisable transformation.

The Industrial Internet of Things (IIoT) has brought transformative changes to industrial sectors by enabling intelligent automation, real-time monitoring, and data-driven decision-making. However, this increased connectivity and system integration have expanded the cybersecurity threat landscape, exposing critical infrastructure to sophisticated cyberattacks. Traditional Intrusion Detection Systems (IDS), particularly those relying on static signature-based detection, have proven inadequate in addressing the dynamic, heterogeneous, and resource-constrained nature of IIoT environments. Motivated by these emerging challenges, this paper presents a comprehensive review of AI-based IDS solutions developed over the past decade, with a specific focus on IIoT contexts. In doing so, it addresses key limitations in prior literature, including an insufficient focus on industry-specific constraints, a lack of attention to explainability and adversarial robustness, and an absence of a structured, future-oriented research agenda. The primary objectives are to synthesize the evolution of IDS methodologies, provide a multidimensional taxonomy that incorporates learning paradigms, deployment layers, and resource constraints, and critically assess the suitability of available datasets and benchmarks. The review highlights significant shifts from conventional machine learning techniques toward more adaptive, lightweight, explainable, and federated learning approaches. Additionally, it proposes a structured research roadmap outlining short-, mid-, and long-term directions for enhancing IDS in IIoT, such as edge-based detection, the integration of explainable AI (XAI), and the development of resilient, self-adaptive intrusion detection architectures. This paper offers a unified, actionable reference for researchers, practitioners, and policymakers seeking to strengthen industrial cybersecurity in increasingly complex and intelligent IIoT systems.

The integration of IDS and Internet of Things (IoT) with deep learning plays a significant role in safety. Security has a strong role to play. Application of the IoT network decreases the time complexity and resources. In the traditional intrusion detection systems (IDS), this research work implements the cutting-edge methodologies in the IoT environment. This research is based on analysis, conception, testing and execution. Detection of intrusions can be performed by using the advanced deep learning system and multiagent. The NSL-KDD dataset is used to test the IoT system. The IoT system is used to test the IoT system. In order to detect attacks from intruders of transport layer, efficiency result rely on advanced deep learning idea. In order to increase the system performance, multi -agent algorithms could be employed to train communications agencies and to optimize the feedback training process. Advanced deep learning techniques such as CNN will be researched to boost system performance. The testing part an IoT includes data simulator which will be used to generate in continuous of research work finding with deep learning algorithms of suitable IDS in IoT network environment of current scenario without time complexity.

With the development of Internet of Things communities, the complexity and scale of cyber security threats multiply swiftly in these intelligent cities and their connected digital infrastructure. As hybrid computing and cyber environment continue to develop, NGID systems become increasingly fragile because of their lack of adaptability and the ability to understand local context to accurately detect the cyber-attacks in dynamic cyber environment like cloud computing. The current work investigates the design and deployment of context-awareness intrusion detection systems (IDS) based on advanced artificial intelligence (AI) approaches to improve a security framework in smart city. Utilizing the real time environmental, network and user behavior data, the IDS models introduced here can optimize detection parameters as dynamic, to improve the anomaly recognition, false positives’ reduction and response time. The research is aiming at combining context information from multiple and diverse internet of things devices, and sensors, and communication networks, so as to enable AI algorithms to build a complete situational awareness model. Such context-aware processing enables the IDS to draw the borderline between normal operation and attacks more accurately. Machine learning techniques, like deep learning and reinforcement learning, can be used to continuously enhance the power of detection over adaptive leaning and build robustness against zero-day attacks and adaptive threats. In addition, the software architecture highlights fog computing for real-time threat detection and transmission from edge to network and it emphasizes a decentralized processing system at the edge of the network while maintaining data privacy. Experimental results, analyzed on several simulated smart city networks, clearly show that the context-aware AI-based IDS performs considerably better than traditional IDSs on detecting a variety of cyber threats like DDoS attacks, data breaches, and unauthorized access attempts. The results demonstrate the system's strength, scalability, and efficiency, which points a promising trend for securing the digital backbone of the future smart cities. This work paves the way for smarter, secure urban ecosystems by leveraging AI and context-awareness in the domain of cybersecurity.

Distributed denial-of-service (DDoS) attacks continue to grow at a rapid rate plaguing Internet Service Providers (ISPs) and individuals in a stealthy way. Thus, intrusion detection systems (IDSs) must evolve to cope with these increasingly sophisticated and challenging security threats. Traditional IDSs are prone to zero-day attacks since they are usually signature-based detection systems. The recent advent of machine learning and deep learning (ML/DL) techniques can help strengthen these IDSs. However, the lack of up-to-date labeled training datasets makes these ML/DL based IDSs inefficient. The privacy nature of these datasets and widespread emergence of adversarial attacks make it difficult for major organizations to share their sensitive data. Federated Learning (FL) is gaining momentum from both academia and industry as a new sub-field of ML that aims to train a global statistical model across multiple distributed users, referred to as collaborators, without sharing their private data. Due to its privacy-preserving nature, FL has the potential to enable privacy-aware learning between a large number of collaborators. This paper presents a novel framework, called MiTFed, that allows multiple software defined networks (SDN) domains ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$i.e.,$</tex-math></inline-formula> collaborators) to collaboratively build a global intrusion detection model without sharing their sensitive datasets. In particular, MiTFed consists of: (1) a novel distributed architecture that allows multiple SDN based domains to securely collaborate in order to cope with sophisticated security threats while preserving the privacy of each SDN domain; (2) a novel Secure Multiparty Computation (SMPC) scheme to securely aggregate local model updates; and (3) a blockchain based scheme that uses Ethereum smart contracts to maintain the collaboration in a fully decentralized, trustworthy, flexible, and efficient manner. To the best of our knowledge, MiTFed is the first framework that leverages FL, blockchain and SDN technologies to mitigate the new emerging security threats in large scale. To evaluate MiTFed, we conduct several experiments using real-world network attacks; the experimental results using the well-known public network security dataset NSL-KDD show that MiTFed achieves efficiency and high accuracy in detecting the new emerging security threats in both binary and multi-class classification while preserving the privacy of collaborators, making it a promising framework to cope with the new emerging security threats in SDN.

Comprehensive fault diagnosis for multiple coupled SFCs based on deep learning

The rise of sophisticated cyber threats has spurred advancements in Intrusion Detection Systems (IDS), which are crucial for identifying and mitigating security breaches in real-time. Traditional IDS often rely on complex machine learning algorithms that lack transparency despite their high accuracy, creating a "black box" effect that can hinder the analysts' understanding of their decision-making processes. Explainable Artificial Intelligence (XAI) offers a promising solution by providing interpretability and transparency, enabling security professionals to understand better, trust, and optimize IDS models. This paper presents a systematic review of the integration of XAI in IDS, focusing on enhancing transparency and interpretability in cybersecurity. Through a comprehensive analysis of recent studies, this review identifies commonly used XAI techniques, evaluates their effectiveness within IDS frameworks, and examines their benefits and limitations. Findings indicate that rule-based and tree-based XAI models are preferred for their interpretability, though trade-offs with detection accuracy remain challenging. Furthermore, the review highlights critical gaps in standardization and scalability, emphasizing the need for hybrid models and real-time explainability. The paper concludes with recommendations for future research directions, suggesting improvements in XAI techniques tailored for IDS, standardized evaluation metrics, and ethical frameworks prioritizing security and transparency. This review aims to inform researchers and practitioners about current trends and future opportunities in leveraging XAI to enhance IDS effectiveness, fostering a more transparent and resilient cybersecurity landscape.

The rapid expansion of Internet of Things (IoT) networks has introduced new cybersecurity risks, particularly due to their heterogeneous, dynamic, and resource-constrained nature. Intrusion Detection Systems (IDS) are commonly used to detect cyber threats in such environments, but traditional IDSs and many machine learning (ML) or deep learning (DL)-based methods face challenges. These include poor detection of unknown attacks, dependence on large datasets, static feature learning, and an inability to adapt to evolving traffic patterns without frequent retraining. Furthermore, while graph-based IDSs capture relational context, their high computational cost and difficulty in adapting to dynamic IoT networks hinder their scalability. To address these challenges, we propose LNNIDS , a novel IDS method that integrates spike encoding with a Hybrid Liquid Neural Network (HLLN) to capture the temporal evolution of IoT attack network traffic. To further enhance accuracy, we introduce DYNGraph , a dynamic graph-based method that performs n → 1 pattern clustering for scalable attack classification. This allows the LNNIDS to dynamically group related flow behaviors and adapt to new or unknown attacks without retraining. We evaluated LNNIDS on two public IoT datasets. This method achieved 99.50% accuracy and maintained robust performance with only 20% training data. Furthermore, we compared the LNNIDS with the seven recent state-of-the-art methods, and we found that LNNIDS outperformed them in the detection of known and unknown IoT attacks with 13.45% and 11.99% better accuracy, respectively.

The substantial growth of Internet-connected devices within the Internet of Things (IoT) has given rise to significant security challenges. Among the various threats confronting these interconnected devices, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks emerge as significant concerns. The attacks, which seek to disrupt IoT services by flooding networks with unnecessary traffic, there is a critical need for robust security measures. Intrusion Detection Systems (IDS) are vital in identifying suspicious activities, yet many existing systems lack real-time capabilities to address evolving attack strategies. This study investigates the vulnerabilities of IoT networks and the pressing need to detect and classify DoS/DDoS attacks in real time. Traditional IDS, while effective in recognizing known attack patterns, fall short in identifying new attack types due to their reliance on historical data. To bridge this gap, this research focuses on developing an enhanced hybrid network intrusion detection and classification system. This study seeks to make contribution to the advancement of resilient security measures within IoT environments. The framework uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks to efficiently detect and categorize DoS/DDoS attacks in real time. To achieve this, a simulation model implementing the proposed hybrid algorithm will be developed. The framework utilized the MQTT-IoT-IDS2020 dataset, and a comparison was presented with recent approaches found in the literature. The results demonstrated enhanced performance in terms of true positive rate, accuracy, speed of detection.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.