Intrusion Detection System using Metaheuristic Algorithm

Recent advancements in technology, particularly in artificial intelligence (AI) and machine learning (ML), have significantly enhanced connectivity and efficiency in various domains. However, these developments have also led to increased threats and concerns regarding cyberattacks which have significantly challenged governments, businesses, and societies. An Intrusion Detection System (IDS) is a critical component of a cybersecurity architecture that is designed to monitor and analyze network traffic for signs of malicious activity and plays an essential role in detecting and responding to security threats. The increasing complexity of security attacks has led researchers to use machine learning (ML) and deep learning (DL) methods to enhance IDS performance. These cutting-edge systems are designed to detect emerging cyberthreats. The current study investigates and compares various types of IDS and AI-based techniques that use ML and DL algorithms to protect data against malicious threats. It also provides an overview of the architecture and operation of IDS and examines popular datasets such as CIC-IDS2017, KDDCup99 and UNSW-NB15 used to evaluate IDS models. These datasets offer a diverse range of attack scenarios and normal traffic and help create a more reliable and effective IDS which improves the overall network security. The study concludes by emphasizing constant progress in IDS technologies to combat evolving cyberthreats and enhance network security.

An intrusion detection system (IDS) inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system. A networkbased system, or NIDS, the individual packets flowing through a network are analyzed. In a host-based system, the IDS examines at the activity on each individual computer or host. IDS techniques are divided into two categories including misuse detection and anomaly detection. In recently years, Mobile Agent based technology has been used for distributed systems with having characteristic of mobility and autonomy. In this working we aimed to combine IDS with Mobile Agent concept for more scale, effective, knowledgeable system.

A comparative performance evaluation of intrusion detection techniques for hierarchical wireless sensor networks

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Modeling IDS have been focused on improving detection model(s) in terms of (i) detection model design based on classification algorithm, clustering algorithm, and soft computing techniques such as Artificial Neural Networks (ANN), Hidden Markov Model (HMM), Support Vector Machines (SVM), K-means clustering, Fuzzy approaches and so on and (ii) feature selection through wrapper and filter approaches. However these approaches require large overhead due to heavy computations for both feature selection and cross validation method to minimize generalization errors. In addition selected feature set varies according to detection model so that they are inefficient for modeling lightweight IDS. Therefore this paper proposes a new approach to model lightweight Intrusion Detection System (IDS) based on a new feature selection approach named Correlation-based Hybrid Feature Selection (CBHFS) which is able to significantly decrease training and testing times while retaining high detection rates with low false positives rates as well as stable feature selection results. The experimental results on KDD 1999 intrusion detection datasets show the feasibility of our approach to enable one to modeling lightweight IDS.

The world has experienced a radical change due to the internet. Internet became a crucial element in our daily life, therefore, the security of our DATA could be threatened at any time. This safety is handled using systems to detect network intrusion called Intrusion Detection Systems (IDS). Machine learning techniques are being implemented to improve these systems. In order to enhance the performance of IDS, different classification algorithms are applied to detect various types of attacks. Choosing a good one for building IDS is not an easy task. The best method is to test the performance of the different classification algorithms. Nevertheless, most researchers have focused on the confusion matrix as measurements of classification performance. Therefore, many papers use this matrix to present a detailed comparison with the dataset, data preprocessing, feature selection technique, algorithms classification and performance evaluation. The goal of this paper is to present a comparison of application of different Machine Learning algorithms used to build and improve intrusion detection systems in terms of confusion matrix, accuracy, recall, precision, FAR, specificity and sensitivity using the UNSW-NB15 Dataset. Furthermore, we introduce some lesson learnt to shoot more researchers in their future works.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

With the growth of 5G wireless technologies and IoT, it become urgent to develop robust network security systems, such as intrusions detection systems (IDS) to keep the networks secure. These IDS systems need to detect unauthorized access and in real-time. However, most of the modern IDS are built based on complex machine learning models that are time-consuming to train. In this work, we propose a methodology using the SHapley Additive exPlanations (SHAP) in combination with tree-based classifiers. SHAP can be used to select consistent and small feature subsets to reduce the execution time and improve classification accuracy. We demonstrate the proposed approach with the Aegean Wi-Fi Intrusion Dataset (AWID) dataset in a series of multi-class classification experiments. Among the four classes (normal, injection, flooding and impersonation), it is well-known that the class impersonation is hard to be classified accurately. Tests show that we can use about 10% of the initial feature set without reducing the overall prediction accuracy. With this reduced set of features, the training time could be reduced as much as a factor of four, while slightly improving the discriminating ability to identify impersonation instances. This study suggests that by reducing the number of features, the classification algorithms are able to focus on key trends that differentiates the attacks classes from the normal class. Using a reduces subset of features improves IDS's accuracy and performance. Also, SHAP dependence plots capture the relationship between individual features and the classification decision.

In the recent years, the improvement in the security is a challenging task in the Internet environment The Intrusion Detection System (IDS) is one of the significant tools used to detect the attacks. Various IDS techniques have been proposed to identify the attacks and alert the user or administrator about the attacks. However, they are unable to manage new attacks. This paper proposes an Intrusion Detection System based on the density maximization-based fuzzy c-means clustering (DM-FCC). In this approach, cluster efficiency is improved through a membership matrix generation (MMG) algorithm. Dissimilarity Distance Function (DDF) has been used to compute the distance metric while creating a cluster in proposing an IDS. The proposed enhanced fuzzy c-means algorithm has been tested upon ADFA Dataset and the model performs highly appreciable in terms of accuracy, precision, detection rates, and false alarms.

The advent of IoT technology and the increase in wireless networking devices has led to an enormous increase in network attacks from different sources. To maintain networks as safe and secure, the Intrusion Detection System (IDS) have become very critical. Intrusion Detection Systems (IDS) are designed to protect the network by identifying anomaly behaviors or improper uses. Intrusion Detection systems provide more meticulous security functionality than access control barriers by detecting attempted and successful attacks at the end-point or within the network. Intrusion prevention systems are the next logical step to this approach as they can take real-time action against breaches. To have an accurate IDS, detailed visibility is required into the network traffic. The intrusion detection system should be able to detect inside the network threats as well as access control breaches. IDS has been around for a very long time now. These traditional IDS were rules and signature-based. Though they were able to reduce false positives they were not able to detect new attacks. In today's world due to the growth of connectivity, attacks have increased at an exponential rate and it has become essential to use a data-driven approach to tackle these issues. In this paper, the KDD data set was used to train the unsupervised machine learning algorithm called Isolation Forest. The data set is highly imbalanced and contains various attacks such as DOS, Probe, U2R, R2L. Since this data set suffers from a redundancy of values and class imbalance, the data preprocessing will be performed first and also used unsupervised learning. For this network traffic based anomaly detection model isolation forest was used to detect outliers and probable attacks the results were evaluated using the anomaly score.

Objective. The aim of the study is to generalize the experience of using and reveal the features of methods for classifying and clustering images obtained by laser scanning.Method. The study is based on the use of algorithms for recognition, clustering and classification of data obtained using laser scanning.Result. A brief review of existing algorithms used for clustering images obtained by laser scanning has been carried out. The possibility of using sequentially the K-means and DBSCAN algorithms for clustering in relation to objects of various shapes is shown. The possibilities of using algorithms for the classification and clustering of laser reflection points (k-Means, DBSCAN, SVM) in the framework of solving territorial planning problems are analyzed.Conclusion. The use of the presented algorithms makes it possible to form data arrays that, when superimposed on each other subsequently and further processed, make it possible to obtain even more accurate representations of objects and territories in territorial planning documents, and in the future, based on the use of machine learning methods and processing of data matrices available in memory, get more accurate information about objects on the ground.

Machine learning (ML) techniques are essential in the detection of network attacks and enhancing network security. A device or software that recognizes any unusual pattern in the network and alerts the user about the same is an intrusion detection system (IDS). In this chapter, we have described the use of ML classification algorithms on the UNSW-NB15 dataset, leading to the generation of a network intrusion detection model which classifies incoming traffic into malicious or non-malicious traffic and issues an alert to the user. We have implemented the following ML algorithms – support vector machine, artificial neural network, and one-class support vector machine with an average accuracy of 89.25%, 91.54%, and 93.05%, respectively. Two graphical user interfaces (online and offline versions) have been developed for the system. Thus, the chapter proposes an optimized intrusion detection system that improves upon the existing intrusion detection systems which detect malicious packets in the network.

Wireless Sensor Networks (WSNs) have become a hot research topic in recent years. They have many potential applications for both civil and military tasks. However, the unattended nature of WSNs and the limited computational and energy resources of their nodes make them susceptible to many types of attacks. Intrusion detection is one of the major and efficient defence methods against attacks in a network infrastructure. Intrusion Detection Systems can be seen as the second line of defence and they complement the security primitives that are adopted in order to prevent attacks against the computer network being protected. The peculiar features of a wireless sensor network pose stringent requirements to the design of intrusion detection systems. In this paper, we propose a hybrid, lightweight, distributed Intrusion Detection System (IDS) for wireless sensor networks. This IDS uses both misuse-based and anomaly-based detection techniques. It is composed of a Central Agent, which performs highly accurate intrusion detection by using data mining techniques, and a number of Local Agents running lighter anomaly-based detection techniques on the motes. Decision trees have been adopted as classification algorithm in the detection process of the Central Agent and their behaviour has been analysed in selected attacks scenarios. The accuracy of the proposed IDS has been measured and validated through an extensive experimental campaign. This paper presents the results of these experimental tests.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.