Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks

At present, the electric power information system has been more widely used. The power sector in the realization of management information at the same time, its security problems are also increasingly severe. It can be said that the security problem of the electric power information has become a hidden danger to the safe and stable operation of the power system. There is a corresponding intrusion problem in the power information network, which affects the stability and security of the power system to a great extent. Aiming at the problem of a long time and low accuracy of network intrusion detection in the power monitoring systems, this paper proposes a method of network intrusion detection in power monitoring systems based on data mining technology. The method can ensure the safe and stable operation of the power monitoring system. This method needs to extract the data characteristics of network intrusion as the initial data set of intrusion detection method, and then apply the clustering partition method to preprocess the data to provide accurate data basis for intrusion detection method, and finally, based on data mining technology, complete the intrusion detection of power monitoring system network. A simulation experiment is designed to test the feasibility and accuracy of the method, and the experimental results show that, compared with the traditional intrusion detection method, the proposed method is faster by about 1.8s, the intrusion detection accuracy is higher by 15.6% for 500 groups of data, and the false alarm rate is lower by 12.3%. It can be proved that the design method in this paper has high efficiency and accuracy, and can provide technical support for the safe operation of the power system.

ANID-SEoKELM: Adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features

In this paper, it presented the method of network intrusion detection based on the neural network GCBP algorithm. By analyzing and comparing the BP algorithm with the GCBP algorithm, what learned is that the GCBP algorithm had overcome the weaknesses, which traditional BP algorithm has of slow convergent speed and easily getting into local minimum. Applicable effects of the method of the intrusion detection are much better, more highly accurate, and greater adaptively. I also showed the ability of more quickly learning. To a great extent, it can achieve the detection of unknown data packets, providing an effective way to efficiently and accurately realize intrusion detection.

Intrusion Detection Systems (IDS) are integral to ensuring network security. However, in practical settings, network traffic data often exhibits significant imbalances, affecting both labeled and unlabeled data distributions. Such imbalances notably degrade the performance of existing intrusion detection methods, particularly in semi-supervised learning contexts, where traditional approaches struggle to effectively leverage large amounts of unlabeled data for enhanced detection capabilities. This paper introduces a semi-supervised learning approach based on normalizing flows to mitigate the data imbalance issue in network intrusion detection. Normalizing flows construct flexible and invertible probabilistic models that can accurately capture and generate complex, highdimensional network traffic data distributions. Specifically, this method utilizes a small amount of labeled data for initial training and incorporates manifold learning and self-training with unlabeled data to adapt the model to the imbalance in the unlabeled data distribution, thereby improving overall detection performance. Experimental results demonstrate that this method outperforms traditional approaches in addressing data imbalance in intrusion detection. The proposed method not only improves detection accuracy and recall but also significantly reduces reliance on data distribution assumptions, demonstrating robustness and generalization across diverse network traffic datasets.

Network intrusion detection identifies malicious activity in the network by analyzing the behavior of network traffic. As an important part of network intrusion detection, feature extraction plays a crucial role in improving the performance of intrusion detection. This research proposes a novel secondary feature extraction method called L-KPCA based on the Liner Discriminant Analysis (LDA) and Kernel Principal Component Analysis (KPCA), to provide efficient features for network intrusion detection. While maintaining the effectiveness of processing nonlinear data in network traffic, the use of LDA effectively compensates for the problem that KPCA only focuses on the analysis of features in terms of variance and ignores the performance of features in terms of mean. Extensive experimental results verify that the use of the proposed, L-KPCA can make the intrusion detection classification model perform better in terms of recognition accuracy and recall.

With the rapid development of Internet technologies, network security threats have significantly increased, emphasizing the need for accurate and efficient network intrusion detection systems (IDS). While traditional IDS methods rely on manual feature selection or deep learning, these approaches often fail to capture the full complexity of network data, especially the diverse structural and content‐related features. To address these limitations, this paper proposes a novel self‐supervised contrastive learning algorithm for network intrusion detection based on a graph isomorphism network ( SCGIN‐ID ). The method transforms network traffic into graph representations, converting the task into a node classification problem. By sampling positive and negative subgraphs centered on target nodes, the proposed approach leverages graph isomorphism networks to capture both structural and content‐based anomalies through self‐supervised contrastive learning. Extensive experiments on two benchmark datasets demonstrate that SCGIN‐ID achieves superior performance compared to five representative baseline models, providing an effective solution for comprehensive and accurate network intrusion detection.

The rise of the new generation of cyber threats demands more sophisticated and intelligent cyber defense solutions equipped with autonomous agents capable of learning to make decisions without the knowledge of human experts. Several reinforcement learning methods (e.g., Markov) for automated network intrusion tasks have been proposed in recent years. In this paper, we introduce a new generation of the network intrusion detection method, which combines a Q-learning based reinforcement learning with a deep feed forward neural network method for network intrusion detection. Our proposed Deep Q-Learning (DQL) model provides an ongoing auto-learning capability for a network environment that can detect different types of network intrusions using an automated trial-error approach and continuously enhance its detection capabilities. We provide the details of fine-tuning different hyperparameters involved in the DQL model for more effective self-learning. According to our extensive experimental results based on the NSL-KDD dataset, we confirm that the lower discount factor, which is set as 0.001 under 250 episodes of training, yields the best performance results. Our experimental results also show that our proposed DQL is highly effective in detecting different intrusion classes and outperforms other similar machine learning approaches.

In light of the escalating ubiquity of the Internet, the proliferation of cyber-attacks, coupled with their intricate and surreptitious nature, has significantly imperiled network security. Traditional machine learning methodologies inherently exhibit constraints in effectively detecting and classifying multifarious cyber threats. Specifically, the surge in high-dimensional network traffic data and the imbalanced distribution of classes exacerbate the predicament of ideal classification performance. Notably, the presence of redundant information within network traffic data undermines the accuracy of classifiers. To address these challenges, this study introduces a novel approach for intrusion detection classification which integrates advanced techniques of feature engineering and model optimization. The method employs a feature engineering approach that leverages mutual information maximum correlation minimum redundancy (mRMR) feature selection and synthetic minority class oversampling technique (SMOTE) to process network data. This transformation of raw data into more meaningful features effectively addresses the complexity and diversity inherent in network data, enhancing classifier accuracy by reducing feature redundancy and mitigating issues related to class imbalance and the detection of rare attacks. Furthermore, to optimize classifier performance, the paper applies the Optuna method to fine-tune the hyperparameters of the Catboost classifier, thereby determining the optimal model configuration. The study conducts binary and multi-classification experiments using publicly available datasets, including NSL_KDD, UNSW-NB15, and CICIDS-2017. Experimental results demonstrate that the proposed method outperforms traditional approaches regarding accuracy, recall, precision, and F-value. These findings highlight the method’s potential and performance in network intrusion detection.

The paper presents the application of the artificial immune systems apparatus as a heuristic method of network intrusion detection for algorithmic provision of intrusion detection systems. The coevolutionary immune algorithm of artificial immune systems with clonal selection was elaborated. In testing different datasets the empirical results of evaluation of the algorithm effectiveness were achieved. To identify the degree of efficiency the algorithm was compared with analogs. The fundamental rules based of solutions generated by this algorithm are described in the article.

The increasing application of machine learning to network intrusion detection has shown great successes in the recent years. To reduce the high dimension of captured network records for classifiers to learn efficiently, various feature reduction methods have been proposed. Using the Information Bottleneck framework, a concise and discriminative feature representation can be derived by optimizing an intuition and theoretically grounded objective function. In this paper, we propose a novel Variational Information Bottleneck method for Network Intrusion Detection that can produce high-quality low-dimensional representation to increase the classification accuracy of conventional machine learning classifier. Moreover, the proposed model is shown to achieve promising accuracy scores in comparison to several state-of-the-art anomaly-based IDS, on both the 2-class classification and 5-class classification intrusion detection problem.

A common problem for network intrusion detection systems is that there are many available features describing network traffic and feature values are highly irregular with burst nature. Some values such as octets transferred range several orders of magnitudes, from several bytes to million bytes. The role of network features depends on which pattern to be detected: normal or intrusive one. Intrusion detection rates would be better if we know which network features are more important for a particular pattern. We therefore propose an automated feature weighting method for network intrusion detection based on a fuzzy subspace approach. Experimental results show that the proposed weighting method can improve the detection rates.

With the rapid development of Internet and information technology, detecting network intrusion behaviors have been attracted more and more attentions. In this paper, we proposed a novel network intrusion detection algorithm using a hybrid ant colony and support vector machine model. Main ideas of SVM are that it denotes a representation of the examples as points in space, and examples of the separate categories are separated by a gap. Afterwards, framework of the detecting network intrusion system is given, which is designed to promote the accuracy of detecting network intrusion by optimizing parameters of support vector machine with ant colony algorithm. Finally, four types of network attack behaviors are utilized in this experiment, that is, a) DOS, b) R2L, c) U2R, and d) Probe. Experimental results demonstrate that the proposed method is able to detect network intrusion with high accuracy.

This paper presents a learning algorithm for adaptive network intrusion detection based on clustering and naïve Bayesian classifier, which induces a hybridization of unsupervised and supervised learning processes. The proposed approach scales up the balance detection rates for different types of network intrusions, and keeps the false positives at acceptable level in network intrusion detection. The algorithm first clusters the network logs into several groups based on similarity of network logs, and then calculates the prior and class conditional probabilities for each cluster. In classifying a new network log, the algorithm calculates the similarity of attribute values of network data with each cluster and initialize a weight value for each cluster. Then each cluster classifies the network data with its priori and conditional probabilities that multiply with respective cluster's weight value. Finally, voting techniques applied for classifying the new network data based on each cluster's classification result. The performance of the proposed algorithm tested by employing KDD99 benchmark network intrusion detection dataset, and the experimental results proved that it improves the detection rates as well as reduces the false positives for different types of network intrusions.

The growing number of interconnected systems in consumer IoT environments and the increasing intelligence of AI-enabled cyber threats have introduced significant security challenges. Intrusion detection systems must be not only accurate but also resilient to evolving threats and robust against adversarial manipulation. A major limitation is the lack of labeled data for evolving adversarial attacks, which limits the generalization of detection models, making them less practical for the dynamic and heterogeneous nature of IoT networks. To overcome these limitations, we propose, a hierarchical graph neural network designed for accurate and resilient network intrusion detection using few labeled examples. utilizes a packet-level graph attention network for adaptive feature filtering, which enhances resilience to subtle data perturbations, coupled with a flow-level temporal model to capture complex spatial and temporal dependencies in traffic patterns. By hierarchically abstracting these features, it learns robust representations of normal and malicious network behavior from limited data. Experimental results on multiple widely used network intrusion datasets demonstrate the ’s remarkable data efficiency and resilience. With as little as 5% of labeled training data, achieves an F1-score of 0.97 and an accuracy of 0.98 across all the benchmarks. Even in extreme data scarcity, using just 0.1% of labeled data, it maintains a high F1-score of 0.94+ and an accuracy of 0.96+. Furthermore, we demonstrate the model’s resilience by evaluating it against common adversarial evasion attacks, such as the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). Under these attacks, ś accuracy only degrades minimally to 0.95, outperforming standard deep learning baselines whose performance drops below 90% under similar conditions. These results validate as a scalable, resilient, and practical method for efficient network intrusion detection with high accuracy and low false positives, even in data-scarce and adversarial IoT environments.

Nowadays, by spreading the usage of the Internet, having a secure communication channels for providing a safe network, is needed. Firewalls are not sufficient enough to prevent attacks among computer networks, because internal attacks are incontrollable. For prevention of these internal attacks, unauthorized intrusion detection systems will be used to secure the network. In this paper, firstly, we define data mining methods, and then we look through various attacks and intrusion detections, and base on these matters, we discuss a data mining-based method for network intrusion detection and attack ontologies.