Intrusion Detection for Network Based on Elite Clone Artificial Bee Colony and Back Propagation Neural Network

Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

A new strategy of dynamic change learning rate in BP neural network was proposed, it changes the learning rate value according to the change of system error between last iteration and this. The method improves the learning rate in BP network. The validity of dynamic change learning rate strategy in BP neural network has been showed by the experiments. In order to improve the detection efficiency of intrusion detection system, a new intrusion detection model was presented, it applies BP neural network based on dynamic change learning rate strategy and combines with the simulated annealing algorithm aim at optimizing intrusion detection system. Finally, the tests show the intrusion detection model improves the detection efficiency.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

With the development of 5G technology, internet traffic has surged dramatically, presenting severe challenges to cybersecurity. Considering that network traffic exhibits temporal correlation, it can be used as a basis for identifying network attacks. In this paper, a joint framework of network traffic interpolation and intrusion detection is proposed. First, by leveraging historical network traffic, traffic characteristics can be obtained, allowing for preemptive prevention of network attacks. To obtain network features at equal time intervals, the Lagrange interpolation method is introduced. Second, a deep learning algorithm combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) Networks is proposed to extract spatiotemporal features from network traffic, distinguishing between normal and abnormal network activities. Experimental results based on real network traffic dataset show that the intrusion detection accuracy using CNN and LSTM can reach above 90%, which shows that the proposal can achieve reliable intrusion detection to defend against cyber attacks.

Network intrusion detection is of great significance for network security in Local Area Network (LAN). Traditional methods such as firewalls do not completely protect against attacks on the LAN due to lack of continuous learning. Recently, the ability of convolutional neural networks (CNN) to extract features in the field of computer vision has received extensive attention. CNN can automatically extract effective complex features to adapt to constantly changing environments, which is especially important in network intrusion detection. In this paper, we focus on network security in the LAN. We propose an approach based on CNN to implement intrusion detection in LAN. This approach can effectively identify network attacks and has an accuracy of 98.34% on the KDD99 dataset. The experimental results show that the proposed approach based on the CNN has high accuracy in intrusion detection.

Cybersecurity has risen to the pinnacle of technological concern due to the exponential growth in the variety and sophistication of cyberthreats. Network attacks are currently the most urgent problem facing contemporary civilization. To identify and stop hostile assaults inside networks, there has to be an intrusion detection system in place. In several industries, most notably information security, effective detection systems for intrusions are being developed using machine learning and deep learning. This is an investigation of how ML methods may be used to enhance cybersecurity defences, with a focus on network intrusion detection, prevention, and response. This study inspects the efficacy of machine learning, utilising CNN, ANN, and LSTM, and assesses them using F1-score, accuracy, recall, and precision. Outcomes demonstrate that CNN outperforms other models, achieving 99% in all key metrics, making them highly effective for detecting network intrusion. However, the study's reliance on the NSL-KDD dataset presents limitations, as it may not fully capture modern network intrusion. Future research should incorporate more recent datasets, real-time performance evaluations, and hybrid models to improve network intrusion detection accuracy and efficiency

A new round of scientific and technological revolution and industrial reform promote the intelligent development of automobile and promote the deep integration of automobile with Internet, big data, communication and other industries. At the same time, it also brings network and data security problems to automobile, which is very easy to cause national security and social security risks. Intelligent vehicle Ethernet intrusion detection can effectively alleviate the security risk of vehicle network, but the complex attack means and vehicle compatibility have not been effectively solved. This research takes the vehicle Ethernet as the research object, constructs the machine learning samples for neural network, applies the self coding network technology combined with the original characteristics to the network intrusion detection algorithm, and studies a self-learning vehicle Ethernet intrusion detection algorithm. Through the application and test of vehicle terminal, the algorithm generated in this study can be used for vehicle terminal with Ethernet communication function, and can effectively resist 34 kinds of network attacks in four categories. This method effectively improves the network security defense capability of vehicle Ethernet, provides technical support for the network security of intelligent vehicles, and can be widely used in mass-produced intelligent vehicles with Ethernet.

In this paper, an intrusion detection system is introduced that uses data mining and machine learning concepts to detect network intrusion patterns. In the proposed method, an artificial neural network (ANN) is used as a learning technique in intrusion detection. The metaheuristic algorithm with the swarm-based approach is used to reduce intrusion detection errors. In the proposed method, the Grasshopper Optimization Algorithm (GOA) is used for better and more accurate learning of ANNs to reduce intrusion detection error rate. The role of the GOAMLP algorithm is to minimize the intrusion detection error in the neural network by selecting useful parameters such as weight and bias. Our implementation in MATLAB software and using the KDD and UNSW datasets show that the proposed method detects abnormal, malicious traffic and attacks with high accuracy. The GOAMLP method outperforms and is more accurate than the existing state-of-the-art techniques such as RF, XGBoost, and embedded learning of ANN with BOA, HHO, and BWO algorithms in network intrusion detection.

Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Additionally, a Deep Autoencoder neural network is utilized to automatically extract relevant features from the network traffic. This unsupervised learning approach enables the system to adapt to evolving attack patterns.

The sensor nodes of wireless sensor networks (WSNs) are deployed to an open and unsupervised region, and they are vulnerable to various types of attacks. Intrusion detection system can detect network attacks that nodes suffer from. This paper combines improved particle swarm optimisation (IPSO) algorithm and back-propagation neural network (BPNN), named IPSO-BPNN. We propose an intrusion detection model of WSNs based on a hierarchical structure. First, we use IPSO algorithm to optimise the initial parameters of BPNN to avoid falling into the local optimum. Then, we apply IPSO-BPNN to the intrusion detection of WSNs. Finally, we use benchmark NSL-KDD and UNSW-NB15 datasets to verify the performance of the IPSO-BPNN. The simulation results show that IPSO-BPNN has faster convergence speed, higher detection accuracy rate and lower false positive rate compared with BPNN and BPNN optimised by PSO algorithm, which can meet the WSNs intrusion detection requirements.

Intrusion detection has been widely used in many application domains; thus, it has caught significant attention in academic fields these years. Assembled with more and more sub-systems, the network is more vulnerable to multiple attacks aiming at the network security. Compared with the other issues such as complex environment and resources-constrained devices, network security has been the biggest challenge for Internet construction. To deal with this problem, a fundamental measure for safeguarding network security is to select an intrusion detection algorithm. As is known, it is less effective to determine the abnormal behavior as an intrusion and learn the entire scope of the normal behavior with the traditional anomaly-based algorithm for Internet intrusion detection. In this paper, we propose an intrusion-detecting algorithm of shadowed rough-fuzzy clustering based on Mahalanobis distance, named MSRFCM. It adopts dissimilarity measurement of Mahalanobis distance to identify the relevant variables that significantly influence the clustering performance and reduce the error rate in the process of partitioning clusters with high attribute correlation. And shadowed rough-fuzzy clustering (SRFCM) is applied to obtaining real value-approaching prototypes based on iteration and partitioning the data set into more meaningful clusters. Through simulation with the NSL-KDD intrusion data set and three other intrusion data sets, the Mahalanobis distance-based shadowed rough-fuzzy clustering algorithm has improved performance in intrusion detection.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the "death" of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

Network attacks have become necessary in today’s time due to increased network traffic. To determine whether network traffic is normal or anomalous a supervised machine learning system is developed. A network intrusion detection system (IDS) is a must-have piece of a security system. This proposed study aims to discover new patterns automatically from substantial quantities of network data, reducing time manually compiling intrusion and normal behavior patterns. The best model in terms of detection success rate was discovered using a supervised learning algorithm and feature selection method. AdaBoost outperforms Neural Network, kNN, and Naive Bayes in supervised machine learning with feature selection in this study, with a detection accuracy of 100.00%, 99.30%, 91.60%, and 99.70%, respectively. The Network Intrusion Detection dataset is used to classify network intrusions to evaluate the study and it has also been used in past studies. On the other hand, the proposed model proved to be more effective than other studies in terms of intrusion detection. The proposed approach can be used in various fields, including finance, health, and transportation. Furthermore, additional parameter tuning could be added, and different feature selection techniques could be used to improve the performance of the classifiers.