Network security based combined CNN-RNN models for IoT intrusion detection system

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Chapter 5 - Intrusion Prevention and Detection Systems

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

A Rule Status Monitoring Algorithm for Rule-Based Intrusion Detection and Prevention Systems

Network security is an important factor in securing data on a server, so a server needs to be kept safe from things that could threaten the validity and integrity of stored data. One way that can be used to detect threats on a server is implementing an Intrusion detection system on the server. A literature study conducted on research that implemented intrusion detection systems, found that there was a lack of intrusion detection system research that could detect one type of network security attack with a variety of attack variables and it was also found in research that had successfully implemented an intrusion detection system to detect network security attacks but still incorrectly identifying the type of attack. This research uses the Snort intrusion detection system method with an experimental model of an attack detection system and an Android application which is applied to monitor the statistics of attacks detected on the Xyz University network. The research results showed that the rules created on the IDS can detect network security attacks, especially DoS/DDoS and PortScan attacks. Then an IDS was created that can send application alert notifications and SMS with a response time that is quite responsive based on the NIST Cybersecurity reference with an average of 22 seconds for DoS/DDoS attacks and 21 seconds for Port Scanning attacks. For the percentage results from 3 times testing the rule by sending DoS/DDoS attack packets of 309,462 to 1,459,548, getting a high level of accuracy with an average of 92.1% on first test, 91.7% on the second test and 91.5% on the third test. In the results of testing the PortScan rule by sending 1,001 to 10,564 attack packets, a high level of accuracy was obtained with an average result of 92.2% in the first test, 94.2% in the second test and 93.4% in the third test.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

В статье представлено развитие сигнатурного подхода обнаружения вторжений на основе кластеризации и дерева решений. Также предложен оригинальный способ разработки аномального подхода к обнаружению вторжений, разработана модель функционирования гибридной системы обнаружения вторжений, отличающаяся от известных большей точностью обнаружения, меньшим процентом ложных тревог, приоритезацией сетевых пакетов для анализа, а также решающей основные недостатки аномального и сигнатурного подхода. Introduction: Alongside the development of the Internet, network security has become a crucial requirement. Bugs in software and operating systems result in an increasing number of previously unknown intrusions discovered every day. The harm caused by these intrusions is becoming more and more dangerous. Firewalls can't ensure a complete protection of the network, because they prevent external threats and don't maintain internal attacks. Intrusion detection systems (IDS) solve this problem. The aim of the research is to develop a model of a hybrid intrusion detection system that will use a combination of improved detection methods based on anomalous and signature approach to increase detection accuracy and reduce the level of false alarms. Tasks: development of an improvement for the signature detection method, development of a unique anomaly detection method, development of a unique hybrid model of the intrusion detection system. Methods. To improve the signature detection method, we used machine learning, in particular the C5 algorithm, as well as decision trees. In addition to this, there are presented: storing signature rules with their partial structure in the MongoDB database, the process of clustering rules, building and detecting with the use of a decision tree. There are presented a unique method for detecting anomalies in network traffic with the use of machine learning methods and the theory of finite automata. Besides, there are shown: the detection process with the use of the sliding window technique, machine learning and time automaton; storage of trained models in the MongoDB database, the process of loading anomalies into the signature database with the use of RabbitMQ. Findings. The hybrid IDS with increased detection accuracy and reduced false alarm rate was developed. The developed system was compared with the well-known open-source solutions Snort and Suricata. The signature detection method was improved with machine learning and decision trees, and a unique anomaly detection method that uses machine learning and a time automaton was presented. It allows to detect previously unknown attacks. The practical significance of the work is the partial implementation of the developed system for the Infologistik24 LLC company.

With the rapid development of machine learning and Internet technology, the combination of the two methods is well appreciated recently.An anomaly and intrusion detection system is a mechanism that monitors network or system activities for malicious activities.Intrusion detection and prevention systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts.As far as other usages of Intrusion detection and prevention systems are concerned, such as identifying problems with security policies and deterring individuals from violating security policies.Anomaly detection systems are becoming an important addition to the security infrastructure of nearly every organization.In this paper, we propose a novel mechanism for real-world traffic and research there cases with theoretical analysis.

Uses of Artificial Intelligent Techniques to Build Accurate Models for Intrusion Detection System

The rapid IoT device proliferation has greatly increased the attack exposure, making IoT networks highly susceptible to cyber threats. Conventional intrusion detection systems (IDSs) have trouble with the complexity of IoT networks due to their massive, heterogeneous, and real‐time data streams. It is the immense amount of information produced by various IoT devices (e.g., sensors, cameras, and wearables) that send data streams continuously in real time. This impacts IDSs as it becomes difficult to process, analyze, and identify threats rapidly and precisely. The variety and velocity of data can overwhelm conventional IDSs, resulting in delays, ignored attacks, or false positives, particularly under limited computational resources common in IoT settings. Existing IDS methods frequently have poor scalability, large false‐positive rates, and insufficient real‐time threat detection, failing to ensure both data security and privacy. To address these issues, this paper introduces an optimized deep learning‐driven model called dual sampling dilated pre‐activation residual attention convolutional neural network optimized using greylag goose optimization (DSD‐PRA‐ConNet‐GGO), which integrates blockchain technology for intrusion detection and prevention in IoT networks. The methodology starts with data acquisition from various IoT devices and sensors, such as smart cameras and environmental sensors, to capture traffic patterns and potential intrusions. The system shows superior performance, achieving 15.59% to 36.88% higher accuracy compared to existing methods such as LSTM‐IDS, ML‐XGBoost, RNN‐IDS, and DL‐DFCN, based on evaluations conducted using the BoT‐IoT dataset, which includes a wide range of realistic attack scenarios and benign traffic commonly encountered in IoT environments.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The Internet is the darling of the information age. Its rapid development has brought a lot of wealth to the society, but it has also brought about increasingly serious security problems. In particular, the widespread application of e-commerce has made network security the most important part of the development of network technology. Network security technology is increasingly valued by computer researchers. Most of the existing security products are passive. The firewall can only be statically disabled. Although the Intrusion Detection System can dynamically detect the intrusion behavior, it cannot block the detected attack behavior. However, the impact of the intrusion prevention system on network performance and the high intrusion detection false alarm rate restrict the development and application of the IPS system. Especially on gigabit high-speed networks, performance has become the primary bottleneck of IPS systems. In view of the above problems, this paper proposes a distributed intrusion detection and blocking system that can run efficiently on high-speed networks. Such systems are also known as intrusion prevention systems IPS. Explain the structure of distributed high-speed network intrusion prevention system, and also introduce the related implementation technology and the realization of each part of distributed intrusion prevention system.

With the popularization and development of network knowledge, network intruders are increasing, and the attack mode has been updated. Intrusion detection technology is a kind of active defense technology, which can extract the key information from the network system, and quickly judge and protect the internal or external network intrusion. Intrusion detection is a kind of active security technology, which provides real-time protection for internal attacks, external attacks and misuse, and it plays an important role in ensuring network security. However, with the diversification of intrusion technology, the traditional intrusion detection system cannot meet the requirements of the current network security. Therefore, the implementation of intrusion detection needs diversifying. In this context, we apply neural network technology to the network intrusion detection system to solve the problem. In this paper, on the basis of intrusion detection method, we analyze the development history and the present situation of intrusion detection technology, and summarize the intrusion detection system overview and architecture. The neural network intrusion detection is divided into data acquisition, data analysis, pretreatment, intrusion behavior detection and testing.

The purpose of a Network Intrusion Detection System is to detect intrusive, malicious activities or policy violations in a host or host’s network. In current networks, such systems are becoming more important as the number and variety of attacks increase along with the volume and sensitiveness of the information exchanged. This is of particular interest to Internet of Things networks, where an intrusion detection system will be critical as its economic importance continues to grow, making it the focus of future intrusion attacks. In this work, we propose a new network intrusion detection method that is appropriate for an Internet of Things network. The proposed method is based on a conditional variational autoencoder with a specific architecture that integrates the intrusion labels inside the decoder layers. The proposed method is less complex than other unsupervised methods based on a variational autoencoder and it provides better classification results than other familiar classifiers. More important, the method can perform feature reconstruction, that is, it is able to recover missing features from incomplete training datasets. We demonstrate that the reconstruction accuracy is very high, even for categorical features with a high number of distinct values. This work is unique in the network intrusion detection field, presenting the first application of a conditional variational autoencoder and providing the first algorithm to perform feature recovery.

As Internet of Things devices become widely used in the real-world, it is crucial to protect them from malicious intrusions. However, the data scarcity of IoT limits the applicability of traditional intrusion detection methods, which are highly data-dependent. To address this, in this article, we propose the Open-Set Dandelion Network (OSDN) based on unsupervised heterogeneous domain adaptation in an open-set manner. The OSDN model performs intrusion knowledge transfer from the knowledge-rich source network intrusion domain to facilitate more accurate intrusion detection for the data-scarce target IoT intrusion domain. Under the open-set setting, it can also detect newly-emerged target domain intrusions that are not observed in the source domain. To achieve this, the OSDN model forms the source domain into a dandelion-like feature space in which each intrusion category is compactly grouped and different intrusion categories are separated, i.e., simultaneously emphasising inter-category separability and intra-category compactness. The dandelion-based target membership mechanism then forms the target dandelion. Then, the dandelion angular separation mechanism achieves better inter-category separability, and the dandelion embedding alignment mechanism further aligns both dandelions in a finer manner. To promote intra-category compactness, the discriminating sampled dandelion mechanism is used. Assisted by the intrusion classifier trained using both known and generated unknown intrusion knowledge, a semantic dandelion correction mechanism emphasises easily-confused categories and guides better inter-category separability. Holistically, these mechanisms form the OSDN model that effectively performs intrusion knowledge transfer to benefit IoT intrusion detection. Comprehensive experiments on several intrusion datasets verify the effectiveness of the OSDN model, outperforming three state-of-the-art baseline methods by 16.9%. The contribution of each OSDN constituting component, the stability and the efficiency of the OSDN model are also verified.