Intrusion Measurement and Detection in LAN Using Protocol-Wise Associative Memory

A novel intrusion detection system based on an optimal hybrid kernel extreme learning machine

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

This paper proposes an adaptive on-line intrusion detection model based on incremental rule learning. This model can make self-learning over the ever-emerged new network behavior examples and dynamically modify behavior profile of the model, which overcomes the disadvantage that the traditional static detecting model must relearn over all the old and new examples, even can't relearn because of limited memory size. The experiment results validate the feasibility and effectivity of the presented adaptive intrusion detection model.

This paper proposes anatomy and main functionalities of a distributed framework for supporting adaptive ensemble-based intrusion detection. We start from open issues and limitations of actual state-of-the-art proposals, and we derive a suitable architecture that, based on actual, emerging research trends, finally defines an innovative ensemble-based network intrusion detection system that combines following requirements: distribution, cooperativeness, scalability, multi-scale network traffic analysis, feature selection and extraction. These requirements are recognized by our study as first-class research challenges for next-generation intrusion detection systems.

Aiming at the shortcomings of current intrusion detection, a SOM neural network method based on clustering and network level is proposed in this paper. Through the identification of easy-to-use network intrusion type, the network intrusion data is cleaned and analyzed in a targeted manner and the multi-layer adaptive network intrusion detection clustering model is established. Network intrusion detection clustering result based on this model is compared with result based on other methods. The results show that this model has higher accuracy and equilibrium and the validity and feasibility of the method is further verified.

Intrusion Detection Systems (IDS) have become an important building block of any sound defense network infrastructure. Malicious attacks have brought more adverse impacts on the networks than before, increasing the need for an effective approach to detect and identify such attacks more effectively. In this study two learning approaches, K-Means Clustering and Naive Bayes classifier (KMNB) are used to perform intrusion detection. K-Means is used to identify groups of samples that behave similarly and dissimilarly such as malicious and non-malicious activity in the first stage while Naive Bayes is used in the second stage to classify all data into correct class category. Experiments were performed with KDD Cup '99 data sets. The experimental results show that KMNB significantly improved and increased the accuracy, detection rate and false alarm of single Naive Bayes classifier up to 99.6, 99.8 and 0.5%.

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

The recent rise in both the frequency and sophistication of cyberattacks in particular, those directed towards distributed and resource constrained, cyber physical environments justifies the need for timely, effective, and adaptive intrusion detection in IoT networks, particularly for lightweight, efficient IoT edge implementations. The work presented in this paper addresses the design of a lightweight, feature efficient intrusion detection system using the XGBoost machine learning algorithm. A classification model was trained on both signal and statistical based subsets of features extracted from a dataset, where the model learned to classify the network traffic data as either benign or malicious. A key aspect of the comparison was to separate the performance of the XGBoost model from the performance of ConvNeXT, which seemed to use an image-based approach to represent the network traffic. Results show that the XGBoost model was both accurate and precise, with higher recall and classification accuracy with less misclassification and ConvNeXT showed poor performance for both classes with class imbalance and a higher false negative rate than XGBoost. Results of this study demonstrate that tabular learning methods such as XGBoost can be effective solutions for both static and realtime intrusion detection for IoT environments in an efficient, applicable manner, with the capacity to be feasibly and scalable as an edge deployment without an overly complex processes to go through to transformation a data model.

The pervasive adoption of the Internet of Things (IoT) is accompanied by numerous network security threats, making the timely detection of anomalies in traffic data through intrusion detection increasingly critical. The existing intrusion detection methods based on federated learning can achieve good results under the condition of sufficient labeled data. However, the traffic data of participants in real IoT environments have various characteristics and there are a large amount of unlabeled data, which easily leads to the performance degradation of the intrusion detection model. To address this challenge, this paper proposes a novel federated transfer learning approach for IoT intrusion detection based on multi-party collaboration called MPdetector. MPdetector uses an encoder to extract the feature representation of diverse traffic data from heterogeneous clients, and maps the feature representation of each client to a unified feature space. In addition, a label transfer strategy is introduced to make full use of unlabeled data, and a new mapping function is used to reconstruct the traffic data of each client to expand client's local data set, which can further improve the detection performance of the model in varied and complex IoT environments. Theoretical analysis proves that the entire transfer learning process of MPdetector is conducted within a secure context. Experiments on four widely used intrusion detection datasets show that MPdetector can detect known and unknown abnormal traffic more accurately than the existing three classical intrusion detection algorithms, and has strong generalization. Meanwhile, the detection effect of MPdetector will be further improved with the increase of the volume of labeled traffic.

Network intrusion detection is of great significance for network security in Local Area Network (LAN). Traditional methods such as firewalls do not completely protect against attacks on the LAN due to lack of continuous learning. Recently, the ability of convolutional neural networks (CNN) to extract features in the field of computer vision has received extensive attention. CNN can automatically extract effective complex features to adapt to constantly changing environments, which is especially important in network intrusion detection. In this paper, we focus on network security in the LAN. We propose an approach based on CNN to implement intrusion detection in LAN. This approach can effectively identify network attacks and has an accuracy of 98.34% on the KDD99 dataset. The experimental results show that the proposed approach based on the CNN has high accuracy in intrusion detection.

In the context of a computer system, computer security is the prevention of an illicit action against the system. For this purpose, computer security must determine the difference between normal and harmful activities. These activities can come from outside or from inside the system to be protected. In a similar manner, the role of the Human Immune System (HIS) is to detect and defend against harm. This similarity has inspired approaches in the area of computer security, including the use of immune-based approaches to build Intrusion Detection and Response Systems (IDRSs). As a concrete example, this chapter introduces a new approach for Intrusion Detection (ID) and Intrusion Response (IR) to build a completely distributed and decentralised IDRS for use in computer networks. This approach is called Intrusion Detection and Response extended with Agent Mobility, or IDReAM for short. IDReAM combines Mobile Agents (MAs) with two self-organising paradigms inspired by natural life systems. The Intrusion Detection System (IDS) is inspired by the metaphor of the immune system that protects the human body from external threats. Specialised cells of the immune system, called the T cells, travel around the body to detect possible threats by eliminating the proteins that they do not recognise as safe proteins—referred to as non-self proteins. Intrusion Detection Agents (IDAs) roam the network to detect suspicious behaviours in a manner that mimics the behaviour of T cells. The Intrusion Response System (IRS) also borrows mechanisms from the stigmergic paradigm of a colony of ants. At the time of foraging, the ants use the environment to diffuse a chemical substance called the pheromone which traces the route for the other ants from the nest to the source of food. Intrusion Response Agents (IRAs) roam the network to respond to the IDAs’ alerts, mimicking the behaviour of the ants to trace the route to the alert and give the response. The two natural systems exhibit a social behaviour by the organisation of their entities, T cells and ants, which is not possible without the functionality of mobility.KeywordsIntrusion DetectionAgent MobilityIntrusion Detection SystemComputer SecurityHuman Immune SystemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Reconfigurable wireless networks, such as ad hoc or wireless sensor networks, do not rely on fixed infrastructure. Nodes must cooperate in the multi-hop routing process. This dynamic and open nature make reconfigurable networks vulnerable to routing attacks that could degrade significantly network performance. Intrusion detection systems consist of a set of techniques designed to identify hostile behavior. In this paper, there are several approaches for intrusion detection in reconfigurable network routing such as collaborative, statistical, or machine learning-based techniques. In this paper, we introduce a new approach to intrusion detection for reconfigurable network routing based on linear systems theory. Using this approach, we can discriminate routing attacks by considering the system's z-plane poles. The z-plane can be thought of as a two dimensional feature space that arises naturally. It is independent of the number of network attack detection metrics and does not require extra dimensionality reduction. Two different host-based intrusion detection techniques, inspired by this new linear systems perspective, are presented and analyzed through a case study. The case study considers the effects of attack severity and node mobility to the attack detection performance. High attack detection accuracy was obtained without increasing packet overhead for both techniques by analyzing locally available information.

Intrusion detection has become a critical component of network administration due to the vast number of attacks persistently threaten our computers. Traditional intrusion detection systems are limited and do not provide a complete solution for the problem. They search for potential malicious activities on network traffics; they sometimes succeed to find true security attacks and anomalies. However, in many cases, they fail to detect malicious behaviours (false negative) or they fire alarms when nothing wrong in the network (false positive). In addition, they require exhaustive manual processing and human expert interference. Applying Data Mining (DM) techniques on network traffic data is a promising solution that helps develop better intrusion detection systems. Moreover, Network Behaviour Analysis (NBA) is also an effective approach for intrusion detection. In this paper, we discuss DM and NBA approaches for network intrusion detection and suggest that a combination of both approaches has the potential to detect intrusions in networks more effectively.

Traditionally, researchers have focused on network level intrusion detection and program level intrusion detection to improve computer security. However, neither approach is foolproof. We argue that the internal and external security of a computer system are equally important. Typically, a successful attacker manifests in the form of the attacker becoming a user on the host either with elevated or normal user privileges. At this point, user-level intrusion detection attempts to deter and curtail an attacker even after the system has been compromised. In this work, we introduce a new approach of intrusion detection based on recurrent neural networks (RNNs) to solve the long sequential problem. We build a robust user command sequence-to-sequence model by semantic modeling command. Our model implements the prediction of user command sequence and the prophesying of user behaviors. The experimental results on data sets of Purdue University, SEA and self-collected data show that an accurate, effective and efficient detection can be achieved by using the proposed approach.KeywordsUser behaviorRecurrent neural networksAnomaly intrusion detectionAttacks and defenses

Given the exponential growth of Internet and increased availability of bandwidth, Intrusion Detection has become the critical component of Information Security and the importance of secure networks has tremendously increased. Though the concept of Intrusion Detection was introduced by James Anderson J. P. in the year 1980, it has gained lots of importance in the recent years because of the recent attacks on the IT infrastructure. The main objective of this study is to examine the existing literature on various approaches for Intrusion Detection in particular Anomaly Detection, to examine their conceptual foundations, to taxonomize the Intrusion Detection System (IDS) and to develop a morphological framework for IDS for easy understanding. In this study a detailed survey of IDS from the initial days, the development of IDS, architectures, components are presented.