Intrusion detection based on Core Vector Machine and ensemble classification methods

Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today's network environments, we need a more systematic and automated IDS development process rather that the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Instrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records taht are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Chapter 5 - Intrusion Prevention and Detection Systems

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

The rapid evolution of information and communication technologies leads to a big networks security problem. For this reason, the Intrusion Detection System (IDS) has been developed in order to detect and prevent computer network attacks. However, the majority of IDSs operate on huge network traffic data with many useless and redundant features. Consequently, the IDS generates a lot of false alarms and the intrusion detection process becomes difficult and imprecise. To improve the performance of an IDS, many data dimensionality reduction methods, such as Principal Component Analysis (PCA), have been proposed. However, the classical PCA approach, that is based on the covariance matrix of the data, is very sensitive to outliers. In order to overcome this problem, we propose to introduce a new variant of PCA namely L1-norm PCA. This new method is based on the L1-norm maximization, which is more robust to outliers, instead of the Euclidean norm in the classical PCA. Extensive experiments on the well-known KDDcup99 dataset are exploited for testing the effectiveness of the proposed approach. Obtained results confirm the superiority of L1-norm PCA over the traditional PCA in terms of network attacks detection and false alarms reduction.

The increasing counterfeit of the internet usage has raised concerns of the security agencies to work very hard in order to diminish the presence of the abnormal users from the web. The motive of these illicit users (called intruders) is to harm the system or the network either by gaining access to the system or prohibiting genuine users to access the resources. Hence in order to tackle the abnormalities Intrusion Detection System (IDS) with Data Mining has evolved as the most demanding approach. On the one end IDS aims to detect the intrusions by monitoring a given environment while on the other end Data Mining allows mining of these intrusions hidden among genuine users. In this regard, IDS with Data Mining has been through several revisions in consideration to meet the current requirements with efficient detection of intrusions. Also several models have been proposed for enhancing the system performance. In context to improved performance, the paper presents a new model for intrusion detection. This improved model, named as REP (Reduced Error Pruning) based Intrusion Detection Model results in higher accuracy along with the increased number of correctly classified instances.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Cloud computing is the distributed computing paradigm continually exposed to different attacks and threats of various origins. The data stored in the cloud framework is easier for external and internal intruders, as access to the cloud framework is done through internet services. Various intrusion detection (ID) methods are developed to detect network intruders in the cloud, but these methods are not primarily effective in generating accurate detection results. Hence, an effective intrusion detection system (IDS) is designed to solve the security issues that unfavorably influence the sustainable development of the cloud and enhance the protection of the cloud from malicious attacks. The IDS is modeled using the proposed Feedback Deer Hunting Optimization (FDHO)-based Deep Residual network to detect network intrusions. However, the proposed FDHO algorithm is designed by integrating Feedback Artificial Tree (FAT) with Deer Hunting Optimization (DHOA), respectively. Moreover, the detection of malicious attacks is carried out using a Deep Residual network that significantly increases the training speed, reduces the computational complexity, and generates effective detection results. The performance of the proposed method is comparatively analyzed with the existing techniques, such as Stacked Contractive Auto-Encoder and Support Vector Machine (SCAE+SVM), Artificial Neural Network with ant bee colony optimization algorithm+fuzzy clustering (ANN+ABC+fuzzy clustering), Improved dynamic immune algorithm (IDIA), and Normalized K-means (NK) clustering algorithm with RNN named, (NK-RNN), FAT-based Deep Residual network, and DHOA-based Deep Residual network using the BoT-IoT dataset and KDD cup-99 dataset. The proposed method achieved outstanding performance by considering the metrics, like specificity, accuracy, and sensitivity, with the values of 0.9526, 0.9498, and 0.9214 using the BoT-IoT dataset.

Accurate intrusion detection is necessary to preserve network security. However, developing efficient intrusion detection system is a complex problem due to the nonlinear nature of the intrusion attempts, the unpredictable behaviour of network traffic, and the large number features in the problem space. Hence, selecting the most effective and discriminating feature is highly important. Additionally, eliminating irrelevant features can improve the detection accuracy as well as reduce the learning time of machine learning algorithms. However, feature reduction is an NPhard problem. Therefore, several metaheuristics have been employed to determine the most effective feature subset within reasonable time. In this paper, two intrusion detection models are built based on a modified version of the firefly algorithm to achieve the feature selection task. The first and, the second models have been used for binary and multiclass classification, respectively. The modified firefly algorithm employed a mutation operation to avoid trapping into local optima through enhancing the exploration capabilities of the original firefly. The significance of the selected features is evaluated using a Naïve Bayes classifier over a benchmark standard dataset, which contains different types of attacks. The obtained results revealed the superiority of the modified firefly algorithm against the original firefly algorithm in terms of the classification accuracy and the number of selected features under different scenarios. Additionally, the results assured the superiority of the proposed intrusion detection system against other recently proposed systems in both binary classification and multi-classification scenarios. The proposed system has 96.51% and 96.942% detection accuracy in binary classification and multi-classification, respectively. Moreover, the proposed system reduced the number of attributes from 41 to 9 for binary classification and to 10 for multi-classification.

A new strategy of dynamic change learning rate in BP neural network was proposed, it changes the learning rate value according to the change of system error between last iteration and this. The method improves the learning rate in BP network. The validity of dynamic change learning rate strategy in BP neural network has been showed by the experiments. In order to improve the detection efficiency of intrusion detection system, a new intrusion detection model was presented, it applies BP neural network based on dynamic change learning rate strategy and combines with the simulated annealing algorithm aim at optimizing intrusion detection system. Finally, the tests show the intrusion detection model improves the detection efficiency.

Advancements in machine learning and artificial intelligence have been widely utilised in the security domain, including but not limited to intrusion detection techniques. With the large training datasets of modern traffic, intelligent algorithms and powerful machine learning tools, security researchers have been able to greatly improve on the intrusion detection models and enhance their ability to detect malicious traffic more accurately. Nonetheless, the problem of detecting completely unknown security attacks is still an open area of research. The enormous number of newly developed attacks constitutes an eccentric challenge for all types of intrusion detection systems. Additionally, the lack of a standard definition of what constitutes an unknown security attack in the literature and the industry alike adds to the problem. In this paper, the researchers reviewed the studies on detecting unknown attacks over the past 10 years and found that they tended to use inconsistent definitions. This formulates the need for a standard consistent definition to have comparable results. The researchers proposed a new categorisation of two types of unknown attacks, namely Type-A, which represents a completely new category of unknown attacks, and Type-B, which represents unknown attacks within already known categories of attacks. The researchers conducted several experiments and evaluated modern intrusion detection systems based on shallow and deep artificial neural network models and their ability to detect Type-A and Type-B attacks using two well-known benchmark datasets for network intrusion detection. The research problem was studied as both a binary and multi-class classification problem. The results showed that the evaluated models had poor overall generalisation error measures, where the classification error rate in detecting several types of unknown attacks from 92 experiments was 50.09%, which highlights the need for new approaches and techniques to address this problem.

A novel intrusion detection system based on an optimal hybrid kernel extreme learning machine

Ensuring the safety and reliability of Transportation Cyber-Physical Systems (T-CPS) is critical. However, the increasing interconnectedness of T-CPS exposes them to sophisticated cyberattacks, necessitating robust intrusion detection systems (IDS) to safeguard against evolving threats. This paper aims to enhance the security of T-CPS by addressing two key challenges: effective anomaly detection and handling imbalanced datasets in intrusion detection tasks. In this paper, we propose ReMeNet (Reconstruction Memory Network), a novel intrusion detection model that combines a memory module with a GAN-based architecture to enhance anomaly detection and data reconstruction. To address the challenge of imbalanced datasets, we incorporate a Vector Quantized Wasserstein Generative Adversarial Network (VQ-WGAN) to generate additional samples for underrepresented attack categories, thereby balancing the dataset and improving detection performance. Experimental evaluation on the UNSW-NB15 dataset demonstrates that ReMeNet achieves an accuracy of 91.70%, and an F1-score of 91.63% which outperforms Random Forest by 8.02% and EC-GAN by 3.01%. The results show that ReMeNet effectively handles imbalanced data, improving detection rates across all attack categories in T-CPS.

In recent years, intelligent intrusion detection techniques based on machine learning have been the research spots in the field of intrusion detection. Whereas, as network traffic and network scale increase continually, some current machine learning algorithms can't meet the requirement of the network intrusion detection models for efficiency and accuracy, which restricts the application of machine learning into intrusion detection. In order to enhance the availability and practicality of intelligent intrusion detection system based on machine learning in high-speed network, an improved fast inductive learning method for intrusion detection (FILMID) is designed and implemented. Accordingly, an efficient intrusion detection model based on FILMID algorithm is presented. The experiment results on the standard testing dataset validate the effectiveness of the FILMID based intrusion detection model.