Intrusion Detection and Ejection Framework Against Lethal Attacks in UAV-Aided Networks: A Bayesian Game-Theoretic Methodology

With the wide application of information technolo-gies in communication based train control (CB TC) systems, the information security risks it confronts to are ever increasing. It is very difficult to design an intrusion detection system (IDS) which can detect both known and unknown cyber attacks with high true positive rate (TPR) and low false positive rate (FPR), simultaneously. In this paper, we propose a hybrid intrusion detection system (RIDS) which is composed of a signature-based intrusion detection system (SIDS) and an anomaly-based intrusion detection system (AIDS). An improved stacking ensemble algorithm (ISEA) is proposed to enhance the TPR of the SIDS which uses weighted classification probabilities outputted by base-classifiers to generate meta-features for the meta-classifier. The FPR of the AIDS is significantly reduced through adopting the proposed false positive elimination strategy (FPES). In addition, a Bayesian optimization algorithm is used for hyper-parameters adjustment to optimize the overall performance of the RIDS. The proposed RIDS is evaluated using both a KDD99 dataset and a CBTC dataset collected on a hardware-in-the-Ioop simulation platform. For the KDD99 dataset, the TPR and FPR of the proposed RIDS are 98.6% and 1.3%, respectively. For the CBTC dataset, the TPR and FPR are 98.1% and 1.1 %, respectively. Based on the performance comparison among different RIDSs, it is can be concluded that the proposed RIDS is superior to the existing RIDS in both TPR and FPR.

Recent Advances in Machine-Learning Driven Intrusion Detection in Transportation: Survey

The growing number of interconnected systems in consumer IoT environments and the increasing intelligence of AI-enabled cyber threats have introduced significant security challenges. Intrusion detection systems must be not only accurate but also resilient to evolving threats and robust against adversarial manipulation. A major limitation is the lack of labeled data for evolving adversarial attacks, which limits the generalization of detection models, making them less practical for the dynamic and heterogeneous nature of IoT networks. To overcome these limitations, we propose, a hierarchical graph neural network designed for accurate and resilient network intrusion detection using few labeled examples. utilizes a packet-level graph attention network for adaptive feature filtering, which enhances resilience to subtle data perturbations, coupled with a flow-level temporal model to capture complex spatial and temporal dependencies in traffic patterns. By hierarchically abstracting these features, it learns robust representations of normal and malicious network behavior from limited data. Experimental results on multiple widely used network intrusion datasets demonstrate the ’s remarkable data efficiency and resilience. With as little as 5% of labeled training data, achieves an F1-score of 0.97 and an accuracy of 0.98 across all the benchmarks. Even in extreme data scarcity, using just 0.1% of labeled data, it maintains a high F1-score of 0.94+ and an accuracy of 0.96+. Furthermore, we demonstrate the model’s resilience by evaluating it against common adversarial evasion attacks, such as the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). Under these attacks, ś accuracy only degrades minimally to 0.95, outperforming standard deep learning baselines whose performance drops below 90% under similar conditions. These results validate as a scalable, resilient, and practical method for efficient network intrusion detection with high accuracy and low false positives, even in data-scarce and adversarial IoT environments.

In this work, a Behaviour-based Intrusion Detection Model is suggested. The proposed model can be employed from a single host configuration to a distributed mixture of host-based and network-based Intrusion Detection Systems (IDSs). Unlike most state-of-the-art IDSs that rely on analysing lower-level, raw-data representations, our proposed architecture suggests to use higher-level notions -behaviours- instead; this way, the IDS is able to identify more sophisticated attacks. To assess our premise, a Behaviour-based IDS (BIDS) prototype has been designed and developed that scans file system data to identify attacks. BIDS achieves high detection rates with low corresponding false positive rates, superseding other state-of-the-art file system IDSs.

The increasing complexity of cyber threats targeting cloud infrastructures demands advanced and adaptive intrusion detection systems (IDS). This study explores the application of deep learning (DL) models—Convolutional Neural Networks (CNN), Long Short-Term Memory networks (LSTM), and a hybrid CNN+BiLSTM architecture—for detecting network intrusions using benchmark datasets CIC-IDS2017 and UNSW-NB15. This study contributes by demonstrating how hybrid CNN+BiLSTM architectures enhance intrusion detection accuracy on benchmark datasets, offering low latency and improved recall for rare attack classes, thereby validating their suitability for real-time cloud security deployment. Results show that hybrid CNN+BiLSTM models outperform standalone CNN and LSTM architectures in detection performance, achieving accuracies up to 97.4% on CIC-IDS2017 and 96.85% on UNSW-NB15, while maintaining acceptable latency for real-time deployment. The hybrid model also demonstrates superior F1-scores for rare attack classes and lower false positive rates. The discussion highlights the importance of dataset quality, feature engineering, and the role of adversarial training and model optimization in enhancing robustness. In conclusion, this work affirms the value of hybrid DL architectures for cloud-based IDS and suggests future directions in federated learning, adaptive retraining, and deployment in edge environments.

Chapter 5 - Intrusion Prevention and Detection Systems

In this paper, by combining the known deep learning related literature in the field of intrusion detection, and the existing in the design of intrusion detection system based on the deep learning common low detection efficiency and high rate of false positives, as well as the training data set used by the problems of unbalanced data, etc., through the depth study of feature extraction and data processing ability. To study the intrusion detection method of the Internet of Things based on deep learning. The work and achievements are as follows:First of all, will be used for feature selection embedded model (EM) and used in intrusion detection of the convolution neural network (CNN), combined with lightweight intrusion detection model (XCNN), because it is an embedded model (EM), so can reduce the impact on the equipment, at the same time compared with other algorithms, the computing time is shorter, the same or even better.Second, proposed to the Attention mechanism (Self - Attention) is applied to intrusion detection system, due to the nature of the Attention mechanism, the mechanism and long Attention can greatly reduce the training time, through introducing the residual network, application feature coding technique again the sparse features thickened into low density at high altitudes, and join to its relative position encoding, So it can sense global information and solve the long-term dependence problem of recurrent neural network.Finally, the results of the intrusion detection method were analyzed on the Pthon simulation platform, and the relevant indicators were verified by using THE NSL-KDD dataset, THE CIC-IDS2017 dataset and the CSE-CIC-IDS2018 dataset. The effectiveness of the method was proved by building a laboratory Internet of Things environment for actual testing. The experimental results show that the algorithm can greatly reduce training time, improve training efficiency, and have the same or even better performance results.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Unmanned aerial vehicle intrusion detection: Deep-meta-heuristic system

The inherent complexity and heterogeneity of the Internet of Things (IoT) ecosystem present significant challenges for developing effective intrusion detection systems. While graph deep-learning-based methods have shown promise in cybersecurity applications, existing approaches primarily construct graphs based on physical network connections, which may not effectively capture node representations. This paper proposes a Top-K Similarity Graph Framework (TKSGF) for IoT network intrusion detection. Instead of relying on physical links, the TKSGF constructs graphs based on Top-K attribute similarity, ensuring a more meaningful representation of node relationships. We employ GraphSAGE as the Graph Neural Network (GNN) model to effectively capture node representations while maintaining scalability. Furthermore, we conducted extensive experiments to analyze the impact of graph directionality (directed vs. undirected), different K values, and various GNN architectures and configurations on detection performance. Evaluations on binary and multi-class classification tasks using the NF-ToN IoT and NF-BoT IoT datasets from the Machine-Learning-Based Network Intrusion Detection System (NIDS) benchmark demonstrated that our proposed framework consistently outperformed traditional machine learning methods and existing graph-based approaches, achieving superior classification accuracy and robustness.

The study examined the detection of attacks against computer networks, which is becoming a harder problem to solve in the field of Network security. A problem with current intrusion detection systems is that they have many false positive and false negative events. Most of the existing Intrusion detection systems implemented depend on rule-based expert systems where new attacks are not detectable. In this study, optimization algorithms were added to intrusion detection system to make them more efficient. Self Organizing Migrating Genetic Algorithm (SOMGA) was integrated into intrusion detection system to obtain a more efficient intrusion detection system called ID-SOMGA. This study provides an equally efficient method to implement an intrusion detection system that returns very low false positives. Due to the complexities involved in security issues, and the implementation of the work, selected values of the network log was used to implement the system in order to reduce some of these complexities. The Self Organizing Migrating Genetic Algorithm – Intrusion Detection System was tested and values of the result were compared with that of an IDS with Genetic Algorithm Intrusion Detection System. In terms of detection rates, ID-SOMGA was found to be slower than an IDS with GA, the false positives in ID-SOMGA was lower than what obtains with genetic algorithm. Both schemes were able to identify new patterns almost in the same way. The ID-SOMGA system that was developed improved the security of systems in networked settings allowing for confidentiality, integrity and availability of system resources.

Intrusion detection has been at the center of intense research in the last decade owing to the rapid increase of sophisticated attacks on computer systems. Typically, intrusion detection refers to a variety of techniques for detecting attacks in the form of malicious and unauthorized activities. There are three broad categories of detection approaches: (a) misuse-based technique that relies on pre-specified attack signatures, (b) anomaly-based approach, that typically depends on normal patterns classifying any deviation from normal as malicious; and (c) specification-based technique that although operates in a similar fashion to anomaly-based approach, employs a model of valid program behavior in a form of specifications requiring user expertise. When intrusive behavior is detected, it is desirable to take (evasive and/or corrective) actions to thwart attacks and ensure safety of the computing environment. Such countermeasures are referred to as intrusion response. Although the intrusion response component is often integrated with the Intrusion Detection System (IDS), it receives considerably less attention than IDS research owing to the inherent complexity in developing and deploying response in an automated fashion. As such, traditionally, triggering an intrusion response is left as part of the administrators responsibility, requiring a high-degree of expertise. In this work we present an integrated approach to intrusion detection and response based on the technique for monitoring abnormal patterns in the program behavior. The proposed model effectively combines the advantages of anomaly-based and specification-based approaches recognizing a known behavior through the specifications of normal and abnormal patterns and classifying unknown patterns using a machine-learning algorithm. Such combination not only allows adaptation of the specification-based detection to the new patterns, but also provides a method for automatic development of specifications. In addition to detection, our framework incorporates preemptive response. By preemption, we imply deploying response before a monitored pattern is classified completely as an intrusion. Such response deployment is likely to stop an intrusion before it can affect the system. However, preemption also inherently suffers from false positives; i.e., responses are deployed to deter correct execution which may look intrusive in its initial phase. To reduce false positives, we have developed a multi-phase response selection and deployment mechanism based on the evaluation of the cost information of the system damage caused by potential intrusion and candidate responses.

This study explores the development of robust Intrusion Detection Systems (IDS) to enhance cybersecurity in Wireless Sensor Networks (WSNs) within the evolving Internet of Things (IoT) ecosystem. It leverages a publicly available dataset derived from UNSW-NB15, retrieved from a GitHub repository, capturing diverse network traffic attributes (dttl, swin, dwin, tcprtt, synack, ackdat), protocol-specific indicators (proto tcp, proto udp), and service-specific attributes (service dns). These features enable precise analysis of TCP/IP headers and traffic patterns, supporting multi-class classification into four categories: Analysis, Denial of Service (DoS), Exploits, and Normal. Advanced machine learning algorithms, including Random Forest, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN), were applied with systematic preprocessing (including KNN-based imputation, normalization, and one-hot encoding), feature selection using Random Forest importance, and 5-fold cross-validation. The best performance was achieved by Random Forest (accuracy, precision, recall, and F1-score of 99.9877%), followed by KNN (99.9754%) and SVM (99.9630%). The study demonstrates that combining well-structured models with relevant protocol-level features and robust evaluation strategies can significantly enhance intrusion detection capabilities in IoT-based environments. It reinforces the value of using modern public datasets and interpretable algorithms for building scalable and reliable IDS solutions.