Intrusion detection model using feature extraction and LPBoost technique

An Intrusion detection system (IDS) is extensively used to identify cyber-attacks preferably in real-time and to achieve integrity, confidentiality, and availability of sensitive information. In this work, we develop a novel IDS using machine learning techniques to increase the performance of the attack detection process. In order to cope with high dimensional feature-rich traffic in large networks, we introduce a Bat-Inspired Optimization and Correlation-based Feature Selection (BIOCFS) algorithm and an ensemble classification approach. The BIOCFS is introduced to estimate the correlation of the identified features and to choose the ideal subset for training and testing phases. The Ensemble Classifier (EC) is used to integrate decisions from three different classifiers including Forest by Penalizing Attributes (FPA), Random Forest (RF), and C4.5 based on the rule of average probabilities. The integration of BIOCFS and EC approaches aids to handle multi-class and unbalanced datasets. The performance of the proposed algorithm is evaluated on a well-known dataset NSL-KDD. The experimental results prove that our combined BIOCFS-EC outdoes other relevant methods in the context of appropriate performance measures. More importantly, the proposed IDS decreases the time complexity of training and testing procedure from 39.43 and 2.25 s to 16.66 and 1.28 s, respectively. Also, the proposed approach achieves the maximum classification accuracy of 0.994, precision of 0.993, F-measure of 0.992, the attack detection ratio of 0.992 and the minimum false alarm ratio of 0.008% on the given dataset.

Networks connected to the Internet of Things (IoT) are often vulnerable to attacks. Several existing methods in the intrusion detection system for securing IoT have been presented with ensemble classifier, but it does not accurately classify attack, and also it takes high computation time. With intention of solving the security issues, Intrusion Detection System using Hybrid Evolutionary Lion and Balancing Composite Motion Optimisation Algorithm espoused feature selection with Ensemble Classifier (IDS-IoT-Hybrid ELOA-BCMOA-Ensemble-DT-LSVM-RF-XGBoost) is proposed for Securing IoT Network. At first, data were accumulated from the NSL-KDD data set. Afterward, data is fed to pre-processing, where it restored missing value using mean curvature flow method. At feature selection, optimum features are compiled under Hybrid Evolutionary Lion and Balancing Composite Motion Optimisation Algorithm. Based upon the optimum features, intruders of IoT data are categorised as denial-of-service (DoS), probe, remote to local attack (R2L), user to root attack (U2R), normal (no attack) with the help of Ensemble classifier. Proposed IDS-IoT-Hybrid ELOA-BCMOA-Ensemble-DT-LSVM-RF-XGBoost approach is constructed utilising Python. Then, proposed IDS-IoT-Hybrid ELOA-BCMOA-Ensemble-DT-LSVM-RF-XGBoost approach attains 21.11%, 19.58%, 24.61% and 9.52% higher accuracy; 94.47%, 93.95%, 93.08% and 90.59% lower error rate, and 62.94%, 36.69%, 64.17% and 50.97% less computation time analysed with existing models.

Uses of Artificial Intelligent Techniques to Build Accurate Models for Intrusion Detection System

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

With the widespread use of Internet, the possibilities of exposing confidential data to invaders or attackers increases. Intrusion Detection System (IDS) is used for detecting various intrusions in network environment and to prevent data from malicious attackers. In this paper, a combined algorithm based on Principal Component Analysis (PCA) and Core Vector Machine (CVM), which is an extremely fast classifier, is proposed for intrusion detection. PCA is used as feature extraction technique to select principal features from the intrusion detection KDDCup'99 dataset and an intrusion detection model is constructed by CVM algorithm. The effectiveness of the features selected is also tested on ensemble based classifiers and the results are compared with the standard classifiers.

Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today's network environments, we need a more systematic and automated IDS development process rather that the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Instrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records taht are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs.

The cyber attack has been growing rapidly on IoT(Internet of things). Existing security mechanisms are no longer sufficient to detect and mitigate these attacks. Intrusion Detection Systems have come up as the second line of defense; however, classic techniques have always had problems with novel and complex attacks. This paper presents a proposed hybrid deep learning-based intrusion detection system that combines Autoencoder, LSTM, and CNN architectures in a complementary fashion to achieve accurate and robust intrusion detection. The evaluated system has been tested with the NSL-KDD dataset, where a stratified cross-validation technique is applied for the generalizability of the result. The approach demonstrates very high accuracy, precision, and recall and is markedly superior to traditional and single-model deep learning approaches. Comprehensive literature reviews are provided, motivation and objectives are discussed, research gaps are identified, and the workflow, model architecture, dataset characteristics, and result analysis have been detailed.

The increasing counterfeit of the internet usage has raised concerns of the security agencies to work very hard in order to diminish the presence of the abnormal users from the web. The motive of these illicit users (called intruders) is to harm the system or the network either by gaining access to the system or prohibiting genuine users to access the resources. Hence in order to tackle the abnormalities Intrusion Detection System (IDS) with Data Mining has evolved as the most demanding approach. On the one end IDS aims to detect the intrusions by monitoring a given environment while on the other end Data Mining allows mining of these intrusions hidden among genuine users. In this regard, IDS with Data Mining has been through several revisions in consideration to meet the current requirements with efficient detection of intrusions. Also several models have been proposed for enhancing the system performance. In context to improved performance, the paper presents a new model for intrusion detection. This improved model, named as REP (Reduced Error Pruning) based Intrusion Detection Model results in higher accuracy along with the increased number of correctly classified instances.

Intrusion Detection Systems (IDS) play an important role in identifying possible attacks to the networks. Most algorithms create a model; and the classification is done based on that model. During the classification, one of the main concerns is increasing the accuracy and the reliability. Traditional intrusion detection methods have some problems such as high false alarm rate, low detection compatibility against the new attacks, and insufficient capacity of the analysis. The next issue related to the intrusion detection systems is the feature reduction, extraction, and selection. In this paper, an intrusion detection model was created by genetic algorithms (GA) and the construction of the classifying models based on the training data observed from the genetic algorithm by KNN (K-Nearest Neighbors) algorithm has been taken into consideration. In this algorithm, it is supposed to reduce the false alarm rate in comparison with the previous methods.

Mobile ad hoc networks (MANETs) have gained more interest from consumers and academics than ever before thanks to the proliferation of wireless networks and the expansion of the benefits and uses of communication networks in general. MANETs are useful in a wide variety of settings since they don't rely on a centralised server or other hardware to relay messages or process data packets. It's one of the primary justifications for implementing MANET in many different domains. However, there are also numerous difficulties that have arisen as a result of these networks' rising popularity, with network security being one of the most crucial. There have been challenges with data transmission and reception due to MANETs' weak regulatory and security frameworks; network infiltration has been identified as one of the most pressing concerns. In MANETs, wireless nodes serve as relays and routers, connecting the source and sink nodes. Accordingly, it is now possible for rogue nodes to penetrate networks and destroy data packets. In order to cope with this issue, modern intrusion detection systems (IDSs) are utilised for remote monitoring of the functioning and actions of nodes present in wireless sensor networks. As well as being able to identify hostile nodes in the network, IDSs can often predict how such nodes will act in the future. In this research work, NSL-KDD dataset is used as an input data. SMOTE and Z-score method are used during pre-processing to remove the irrelevant features and normalize the data. The optimal features are carried out by Artificial Butterfly algorithm and then, finally, ensemble classifiers s. Multilayer Perceptron (MLP), Boosted Regression Trees (BRT) and finally, the adaptive voting mechanism is used to select the best classifier. The results proves that the proposed ensemble model achieved 97.16% of accuracy, where the existing models achieved nearly 95% to 96% of accuracy.

Chapter 5 - Intrusion Prevention and Detection Systems

Accurate intrusion detection is necessary to preserve network security. However, developing efficient intrusion detection system is a complex problem due to the nonlinear nature of the intrusion attempts, the unpredictable behaviour of network traffic, and the large number features in the problem space. Hence, selecting the most effective and discriminating feature is highly important. Additionally, eliminating irrelevant features can improve the detection accuracy as well as reduce the learning time of machine learning algorithms. However, feature reduction is an NPhard problem. Therefore, several metaheuristics have been employed to determine the most effective feature subset within reasonable time. In this paper, two intrusion detection models are built based on a modified version of the firefly algorithm to achieve the feature selection task. The first and, the second models have been used for binary and multiclass classification, respectively. The modified firefly algorithm employed a mutation operation to avoid trapping into local optima through enhancing the exploration capabilities of the original firefly. The significance of the selected features is evaluated using a Naïve Bayes classifier over a benchmark standard dataset, which contains different types of attacks. The obtained results revealed the superiority of the modified firefly algorithm against the original firefly algorithm in terms of the classification accuracy and the number of selected features under different scenarios. Additionally, the results assured the superiority of the proposed intrusion detection system against other recently proposed systems in both binary classification and multi-classification scenarios. The proposed system has 96.51% and 96.942% detection accuracy in binary classification and multi-classification, respectively. Moreover, the proposed system reduced the number of attributes from 41 to 9 for binary classification and to 10 for multi-classification.

A new strategy of dynamic change learning rate in BP neural network was proposed, it changes the learning rate value according to the change of system error between last iteration and this. The method improves the learning rate in BP network. The validity of dynamic change learning rate strategy in BP neural network has been showed by the experiments. In order to improve the detection efficiency of intrusion detection system, a new intrusion detection model was presented, it applies BP neural network based on dynamic change learning rate strategy and combines with the simulated annealing algorithm aim at optimizing intrusion detection system. Finally, the tests show the intrusion detection model improves the detection efficiency.

Advancements in machine learning and artificial intelligence have been widely utilised in the security domain, including but not limited to intrusion detection techniques. With the large training datasets of modern traffic, intelligent algorithms and powerful machine learning tools, security researchers have been able to greatly improve on the intrusion detection models and enhance their ability to detect malicious traffic more accurately. Nonetheless, the problem of detecting completely unknown security attacks is still an open area of research. The enormous number of newly developed attacks constitutes an eccentric challenge for all types of intrusion detection systems. Additionally, the lack of a standard definition of what constitutes an unknown security attack in the literature and the industry alike adds to the problem. In this paper, the researchers reviewed the studies on detecting unknown attacks over the past 10 years and found that they tended to use inconsistent definitions. This formulates the need for a standard consistent definition to have comparable results. The researchers proposed a new categorisation of two types of unknown attacks, namely Type-A, which represents a completely new category of unknown attacks, and Type-B, which represents unknown attacks within already known categories of attacks. The researchers conducted several experiments and evaluated modern intrusion detection systems based on shallow and deep artificial neural network models and their ability to detect Type-A and Type-B attacks using two well-known benchmark datasets for network intrusion detection. The research problem was studied as both a binary and multi-class classification problem. The results showed that the evaluated models had poor overall generalisation error measures, where the classification error rate in detecting several types of unknown attacks from 92 experiments was 50.09%, which highlights the need for new approaches and techniques to address this problem.