Mobile agent based intrusion detection system

The security inside the network correspondence is a noteworthy concern. Being the way that information is considered as the profitable asset of an association, giving security against the intruders is exceptionally fundamental. Intrusion Detection Systems tries to recognize security assaults of intruders by researching a few information records saw in forms on the network. In this paper, Intrusion Detection Classification of attacks is done by NNIDS, TSVID and DF-IDS. The proposed algorithms are trained and tested using KDD Cup 1999 dataset . This paper has presented a novel method for an adaptive fault tolerant mobile agent based intrusion detection system. At first the classification of attacks is done by TSVID Classification algorithm. The TSVID makes use of RBF kernel and iterative learning mechanism. Next the classification is done by using NNIDS that makes use of neural network based approach. Advantages of NNIDS method is that it can successfully handle both qualitative, quantitative data, and it handles multiple criteria and easier to understand. Then, finally, the classification is done by using iterative learning mechanism and DF-IDS gives successful results of classification. The performances of the proposed algorithm are evaluated using the classification metrics such as detection rate and accuracy. Comparison graphs of attack detection rate and false-alarm rate reveals that the obtained results of anticipated methods achieve greater detection rate and less computational time for the classification of attacks and protocols. The proposed study is a classification based approach for combining several networks in intrusion detection systems. In evaluation of this model, it has been demonstrated that there is a significant improvement in real time performance without sacrificing efficiency.

In most network management systems, the Intrusion Detection System (IDS) is utilized to detect and prevent suspicious activity. IDS fundamental concept is to use feature values from the capture function of the network packet to classify when an action is irregular. The bulk of conventional classification algorithms, however, are unable to classify unfamiliar behaviors. As a classification algorithm for IDS, the algorithm proposed in this paper would combine clustering, classification, and metaheuristic algorithms to create a high-performance classification algorithm named search economics with k-means support vector machine (SEKS) and search economics with the intrusion detection system (SEIDS). The IDS technique might improve the attack detection accuracy rate by combining methods for unsupervised learning and classification. SEKS and SEIDS are two phases that can be separated from the proposed system. In addition, the suggested algorithm’s hybrid methodology aims to improve the accuracy of detecting abnormal activity in such a system, reduce the classification algorithm’s processing time, and allow the IDS in a network context to detect unfamiliar and novel variant assaults. In terms of accuracy, the suggested approach beats all previous classification methods examined in this research.

A comparative performance evaluation of intrusion detection techniques for hierarchical wireless sensor networks

Intrusion Detection in a network is defined as identifying activities which violate security policies. Traditional Intrusion Detection Systems (IDSs) are centralized in nature where a central node collects data from every node and detects whether any abnormal activity is taking place in the network. In our research we propose to use intelligent mobile agents to detect intrusions in a network. An agent is a piece of program which will execute specified operations on a node in a network. The agents act as guards which essentially roam the network periodically to check whether any node in the network is under attack. When an agent visits a node, it scans the log file to identify any abnormal activity taking place in that node. In our previous research we proposed algorithms for finding initial locations and roaming pattern of agents. In this research, we have built the prototype of an agent and deployed it in a virtual network to test its performance by simulating intrusions. We have also tested the performance of the prototype by deploying the agents on PlanetLab which is a testbed in the Internet connecting more than 1300 machines all over the world. From our experiments we have observed that the performance of the agent based intrusion detection system depends on the size and topology of the network.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Recent advancements in technology, particularly in artificial intelligence (AI) and machine learning (ML), have significantly enhanced connectivity and efficiency in various domains. However, these developments have also led to increased threats and concerns regarding cyberattacks which have significantly challenged governments, businesses, and societies. An Intrusion Detection System (IDS) is a critical component of a cybersecurity architecture that is designed to monitor and analyze network traffic for signs of malicious activity and plays an essential role in detecting and responding to security threats. The increasing complexity of security attacks has led researchers to use machine learning (ML) and deep learning (DL) methods to enhance IDS performance. These cutting-edge systems are designed to detect emerging cyberthreats. The current study investigates and compares various types of IDS and AI-based techniques that use ML and DL algorithms to protect data against malicious threats. It also provides an overview of the architecture and operation of IDS and examines popular datasets such as CIC-IDS2017, KDDCup99 and UNSW-NB15 used to evaluate IDS models. These datasets offer a diverse range of attack scenarios and normal traffic and help create a more reliable and effective IDS which improves the overall network security. The study concludes by emphasizing constant progress in IDS technologies to combat evolving cyberthreats and enhance network security.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Security has become important to mobile ad hoc networks (MANETs) due mainly to their use for many mission and life-critical applications. However, the broadcast nature of inter-node communications and node mobility in MANETs make it very challenging to secure MANETs. Moreover, their constantly changing topology causes network node density and neighbor relationships to change dynamically. This paper presents an intrusion detection system (IDS) for MANETs at the application layer. The IDS utilizes (1) both anomaly and misuse detection schemes to identify attacks in MANETs and (2) mobile agents (MAs) to augment each node's intrusion-detection capability. In particular, each node is equipped with a local IDS, and MAs will be dispatched periodically or on-demand to augment each node's IDS. We present the design of this IDS and the overall network structure, as well as the methods for authenticating and dispatching MAs. We also evaluate the trade-offs between different design parameters of MAs.

In the recent years, the improvement in the security is a challenging task in the Internet environment The Intrusion Detection System (IDS) is one of the significant tools used to detect the attacks. Various IDS techniques have been proposed to identify the attacks and alert the user or administrator about the attacks. However, they are unable to manage new attacks. This paper proposes an Intrusion Detection System based on the density maximization-based fuzzy c-means clustering (DM-FCC). In this approach, cluster efficiency is improved through a membership matrix generation (MMG) algorithm. Dissimilarity Distance Function (DDF) has been used to compute the distance metric while creating a cluster in proposing an IDS. The proposed enhanced fuzzy c-means algorithm has been tested upon ADFA Dataset and the model performs highly appreciable in terms of accuracy, precision, detection rates, and false alarms.

Signature-based intrusion detection systems use a set of attack descriptions to analyze event streams, looking for evidence of malicious behavior. If the signatures are expressed in a well-defined language, it is possible to analyze the attack signatures and automatically generate events or series of events that conform to the attack descriptions. This approach has been used in tools whose goal is to force intrusion detection systems to generate a large number of detection alerts. The resulting "alert storm" is used to desensitize intrusion detection system administrators and hide attacks in the event stream. We apply a similar technique to perform testing of intrusion detection systems. Signatures from one intrusion detection system are used as input to an event stream generator that produces randomized synthetic events that match the input signatures. The resulting event stream is then fed to a number of different intrusion detection systems and the results are analyzed. This paper presents the general testing approach and describes the first prototype of a tool, called Mucus, that automatically generates network traffic using the signatures of the Snort network-based intrusion detection system. The paper describes preliminary cross-testing experiments with both an open-source and a commercial tool and reports the results. An evasion attack that was discovered as a result of analyzing the test results is also presented.

In the context of a computer system, computer security is the prevention of an illicit action against the system. For this purpose, computer security must determine the difference between normal and harmful activities. These activities can come from outside or from inside the system to be protected. In a similar manner, the role of the Human Immune System (HIS) is to detect and defend against harm. This similarity has inspired approaches in the area of computer security, including the use of immune-based approaches to build Intrusion Detection and Response Systems (IDRSs). As a concrete example, this chapter introduces a new approach for Intrusion Detection (ID) and Intrusion Response (IR) to build a completely distributed and decentralised IDRS for use in computer networks. This approach is called Intrusion Detection and Response extended with Agent Mobility, or IDReAM for short. IDReAM combines Mobile Agents (MAs) with two self-organising paradigms inspired by natural life systems. The Intrusion Detection System (IDS) is inspired by the metaphor of the immune system that protects the human body from external threats. Specialised cells of the immune system, called the T cells, travel around the body to detect possible threats by eliminating the proteins that they do not recognise as safe proteins—referred to as non-self proteins. Intrusion Detection Agents (IDAs) roam the network to detect suspicious behaviours in a manner that mimics the behaviour of T cells. The Intrusion Response System (IRS) also borrows mechanisms from the stigmergic paradigm of a colony of ants. At the time of foraging, the ants use the environment to diffuse a chemical substance called the pheromone which traces the route for the other ants from the nest to the source of food. Intrusion Response Agents (IRAs) roam the network to respond to the IDAs’ alerts, mimicking the behaviour of the ants to trace the route to the alert and give the response. The two natural systems exhibit a social behaviour by the organisation of their entities, T cells and ants, which is not possible without the functionality of mobility.KeywordsIntrusion DetectionAgent MobilityIntrusion Detection SystemComputer SecurityHuman Immune SystemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The security of resources in a corporate network is always important to the organization. For this reason, different techniques, such as firewall and intrusion detection systems, are important. Years of long research have resulted in the contribution of different advancements in these techniques. Artificial intelligence, machine learning techniques, soft computing techniques, and bio-inspired techniques have been efficient in detecting advanced network attacks. However, very often, different new attacks are most successful in breaching these detection techniques. This very reason has been a motivation for us to explore the biological aspects and its defense mechanisms for designing a secure network model. After much study, we have identified that plants have a very well-established and evolved detection and a response mechanism to pathogens. In this paper, we have proposed and implemented a network attack detection and a response model inspired by plants. It is a three-layered model in analogy to the three-layer defense mechanism of plants to pathogens. We have further tested the proposed model to different network attacks and have compared the results to the open-source intrusion detection system, Snort. The experimental results also establish that the model is competent to detect and trigger an automated response whenever required.

Cyber criminals have become a formidable treat in today’s world. This present reality has placed cloud computing platforms under constant treats of cyber-attacks at all levels, with an ever-evolving treat landscape. It has been observed that the number of threats faced in cloud computing is rising exponentially mainly due to its widespread adoption, rapid expansion and a vast attack surface. One of the front-line tools employed in defense against cyber-attacks is the Intrusion Detection Systems (IDSs). In recent times, an increasing number of researchers and cyber security practitioners alike have advocated the use of deception-based techniques in IDS and other cyber security defenses as against the use of traditional methods. This paper presents an extensive overview of the deception technology environment, as well as a review of current trends and implementation models in deception-based Intrusion Detection Systems. Issues mitigating the implementation of deception based cyber security defenses are also investigated.

In the field of network security, botnet attacks pose a significant challenge, exploiting networks of infected devices to launch sophisticated threats. As these attacks evolve, the need for effective detection methods becomes increasingly critical. This study proposes an explainable Machine Learning (ML) model that aims to identify and categorize botnet attacks, and it investigates the efficiency of different Explainable Artificial Intelligence (XAI) techniques for Intrusion Detection Systems (IDS). To train our models, we employed a subset of the NCC-2 dataset, which includes a mix of normal traffic and seven different types of botnet attacks across three sensors. The ML techniques selected for this research are Random Forest (RF), Extra Trees (ET), Decision Tree (DT), and K-Nearest Neighbors (KNN), with a GridSearch cross-validation approach for optimal hyperparameter tuning. We also explored the effects of class balance through Synthetic Minority Oversampling (SMOTE) and Random Undersampling. The models’ performance was rigorously tested using the Matthews Correlation Coefficient (MCC) and Macro F1-score, with the ET model demonstrating superior results of 99% MCC and 97% F1-score, respectively. To enhance the interpretability of the ET model’s decision-making process, we integrated three XAI techniques: SHapley Additive exPlanations (SHAP), Dalex, and Local Interpretable Model-agnostic Explanations (LIME), and evaluated their efficiency. The LIME and Dalex techniques showed efficient construction times for IDS.

In the age of the Internet, computer intrusion detections are at best a black art. The science to perceive, track, and understand intrusions is still at its infancy. Many different technologies and topologies are under investigation to see which model provides adequate data for intrusion detection. In this paper, we present a platform independent Java-based mobile agent intrusion detection system (IDS). In our prototype mobile agent IDS, the focus is on port scanning and file integrity checking. The mobile agents are implemented using the Concordia mobile agent development kit. The performance and memory resources required to run these mobile agents are discussed.