On-Line Intrusion Detection Model Based on Approximate Linear Dependent Condition with Linear Latent Feature Extraction

This paper presents an almost unsupervised fusion algorithm on linear features (LF) extraction in synthetic aperture radar (SAR) interferometric data, in particular for mangroves/shorelines and thin internal channels. The spatial information on LFs is first extracted in the coherence image, where they are wider and more visible: water regions (in particular thin internal channels) are dark areas (low coherence) due to the temporal decorrelation of backscattering signals in these and surrounding regions, whereas conventional vegetation regions are brighter areas (high coherence). These approximate locations of LFs are further refined by using the edge map coming from a semantic fuzzy fusion of the coefficient of variation (CV) and the ratio of local means (RLM) measured in the amplitude image. The final detection of LFs is then performed by merging the two fuzzy inputs: the spatial information and the edge location map. The membership degree statistics of CV and RLM semantic fusion measures are introduced in order to illustrate the location detection ability. The originality of this method in comparison with conventional approaches is in the fusion scheme that follows the interpreter behavior by using first the coherence image for a fuzzy detection where thin LFs are more visible, but have low location accuracy, and then the amplitude image where they are poorly visible, but with higher location accuracy, to obtain improved results. A quantitative performance evaluation is also presented. The method has been applied on real interferometric SAR images from European Remote Sensing satellites over the western part of Cameroon.

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.

Attacks against web-based applications is one of the most serious network security threats. At present, web-based attacks are so complex that single detection method is unable to cope with the emerging attacks. Motivated by this, we efficiently merge both misuse detection and anomaly detection, and propose a hybrid model for web log intrusion detection. Considering that a web log request contains the majority of attack features, we propose a method to extract feature vectors of HTTP request to distinguish abnormal behaviors of users. Particularly, we construct a normal access model based on request feature vectors by using K-means clustering algorithm. The test data indicate that compared to single intrusion detection model, the hybrid intrusion detection model proposed can effectively improve the detection rate and reduce the false alarm rate.

This paper proposes an enhanced Transformer-based intrusion detection model to tackle the challenges of lengthy training time, inaccurate detection of overlapping classes, and poor performance in multi-class classification of current intrusion detection models. Specifically, the proposed model includes the following: (i) A data processing strategy that initially reduces the data dimension using a stacked auto-encoder to speed up training. In addition, a novel under-sampling method based on the KNN principle is introduced, along with the Borderline-SMOTE over-sampling method, for hybrid data sampling that balances the dataset while addressing the issue of low detection accuracy in overlapping data classes. (ii) An improved position encoding method for the Transformer model that effectively learns the dependencies between features by embedding the position information of features, resulting in better classification accuracy. (iii) A two-stage learning strategy in which the model first performs rough binary prediction (determining whether it is an illegal intrusion) and then inputs the prediction value and original features together for further multi-class prediction (predicting the intrusion category), addressing the issue of low accuracy in multi-class classification. Experimental results on the official NSL-KDD test set demonstrate that the proposed model achieves an accuracy of 88.7% and an F1-score of 88.2% in binary classification and an accuracy of 84.1% and an F1-score of 83.8% in multi-class classification. Compared to existing intrusion detection models, our model exhibits higher accuracy and F1-score and trains faster than other models.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

A new model of self-adaptive network intrusion detection based on negative selection algorithm is presented to tackle the problem of self continuously changeable in network intrusion detection. The evolvement of self is fully expounded; a new method that generates and evolves detectors is put forward, which can update automatically to keep synchronization with self. The result shows that the model has the properties of self-adaptability & dynamics, and can identify the intrusion effectively.

The increasing counterfeit of the internet usage has raised concerns of the security agencies to work very hard in order to diminish the presence of the abnormal users from the web. The motive of these illicit users (called intruders) is to harm the system or the network either by gaining access to the system or prohibiting genuine users to access the resources. Hence in order to tackle the abnormalities Intrusion Detection System (IDS) with Data Mining has evolved as the most demanding approach. On the one end IDS aims to detect the intrusions by monitoring a given environment while on the other end Data Mining allows mining of these intrusions hidden among genuine users. In this regard, IDS with Data Mining has been through several revisions in consideration to meet the current requirements with efficient detection of intrusions. Also several models have been proposed for enhancing the system performance. In context to improved performance, the paper presents a new model for intrusion detection. This improved model, named as REP (Reduced Error Pruning) based Intrusion Detection Model results in higher accuracy along with the increased number of correctly classified instances.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the "death" of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

In recent years, intelligent intrusion detection techniques based on machine learning have been the research spots in the field of intrusion detection. Whereas, as network traffic and network scale increase continually, some current machine learning algorithms can't meet the requirement of the network intrusion detection models for efficiency and accuracy, which restricts the application of machine learning into intrusion detection. In order to enhance the availability and practicality of intelligent intrusion detection system based on machine learning in high-speed network, an improved fast inductive learning method for intrusion detection (FILMID) is designed and implemented. Accordingly, an efficient intrusion detection model based on FILMID algorithm is presented. The experiment results on the standard testing dataset validate the effectiveness of the FILMID based intrusion detection model.

As a kind of data pre-process method, feature selection is an essential step in intrusion detection modeling. The method can improve the efficiency and accuracy of intrusion detection engine. Additionally, good features can provide excellent class separability. However, in the past researches on feature selection, the criteria and way about how to select the features in the raw data are seldom referred to. This paper shows us which type of features can aid us to achieve a better experimental results. In comparison to various type of intrusion attacks, the classical clustering algorithm, K-Means is proposed to evaluate the features selected and prove the viewpoint based on KDD Cup 1999 DataSet. The knowledge of feature selection can be achieved by this means. With the usage of the statistics of network traffic, the better evaluation index, e.g. detection rate and false positive rate, are achieved than any other type of features. Finally, the paper provides the evaluation results of feature selection and we can regard them as knowledge for our future implementation.

A lot of intrusion and hacking events are surrounding the internet domain, bringing in a need for security systems. Intrusion detection system (IDS) is employed in the network to identify the attacks by continuously monitoring the system activities. The major issue for any intrusion detection model is to identify anomalies with maximum accuracy and minimal false alarms. An intrusion detection model is developed combining chi-square feature selection and LPBoost algorithm. Chi-square feature selection is deployed to build the optimal features as the network traffic data consists of many attributes. The optimum features are utilised by the LPBoost algorithm for classification of network traffic. An ensemble classifier is chosen as it typically outperforms a single classifier. The experiments are performed using NSL-KDD and UNSW-NB data sets. The results clearly show that the hybrid model achieves a higher detection and reduced false positive rate in contrast to other techniques.

Aiming to address the problems of low time efficiency and poor generalization ability in support vector machine (SVM) models when dealing with large‐scale network intrusions, this paper suggests a large‐scale robust intrusion detection model that combines deep neural network (DNN) and multi‐kernel approximate SVM. The DNN conducts representation learning to extract intrinsic features and performs dimensionality reduction on the dataset. The paper leverages the capability of multi‐kernel learning to accommodate the distinct characteristics of various features within the input space. Additionally, it aims to further improve the robustness of the model. The multi‐kernel approximation SVM using random Fourier features to perform kernel approximation can handle large‐scale datasets. The model employs the gradient descent method to train neural networks and multi‐kernel SVM from start to finish. The gradient descent algorithm can effectively maximize convergence toward the global minimum. This, in turn, enhances the overall accuracy of the model. Our model was tested on three intrusion detection datasets of varying scales: UNSW‐NB15, CIC‐IDS2017, and CIC‐IDS2018; and compared with the latest learning models such as gradient boosting tree, CNN, LSTM, GNN, transfer learning, and SVM models of different variants. The accuracy rate of the model proposed in this paper has increased by 1%–4% compared with that of the currently popular intrusion detection models. The experimental findings show that our model has higher classification performance and better robustness when processing large‐scale datasets while reducing time complexity.

In this paper an intrusion detection model is constructed based on the long short-term neural networks. Training of the model and tests on its performance are done with KDD 99 and UNSW-NB15 data-sets by choosing the optimum parameters via experiments. What's more, a comparison is done with the traditional machine learning model. The results show that this intrusion detection model has a higher detection accuracy than the traditional machine learning models. The detection accuracy with respect to the two data-sets is 98.99% and 99.41% respectively.

Exponential growth of novel radical applications and services in sixth-generation (6G) networks is expected to increase the complexity of managing existing network infrastructures. In this context, the zero touch network and service management (ZSM) paradigm, which leverages AI, SDN, and NFV techniques, is seen as a promising solution to automatically manage and orchestrate network resources. However, due to the closed-loop operation and automated end-to-end framework in a distributed 6G network, the ZSM architecture, along with its potential benefits, is exposed to various security threats. A recently proposed solution to address privacy concerns is federated learning (FL), whereby distributed training is performed, and the aggregated model parameters, instead of clients' raw data, are forwarded to the global server. However, most of the existing FL and semi-supervised learning (SSL) models for intrusion detection are based on the assumption that fully labeled data are always available at the server and client sides, which is not practical due to the high labeling costs and privacy constraints in the 6G network. In this article, we propose a novel FL-empowered semi-supervised active learning (FL-SSAL) security orchestration framework for the Label-at-Client scenario where, along with unlabeled samples, clients have a small portion of labeled data. The entropy-based active learning selects the most informative samples for data annotation and leverages the unlabeled data using a semi-supervised approach. The results of our experimental evaluations performed on the private, not independent and identically distributed (non-IID) dataset demonstrate that FL-SSAL achieves higher intrusion detection accuracy and has less communication overhead than baseline schemes with less labeled data.

Network security is essential for both personal and business networks. Somewhat recently, the remarkable development of organization related administrations has brought about an enormous inundation of secret information on the web. Be that as it may, networks are exceptionally defenceless against unauthenticated interruptions. Current digital actual frameworks are getting progressively related. Such interdependencies make new weaknesses and make these frameworks more defenceless to disappointments. There are many cyber-attacks such as Denial of Service attack, Man in the Middle attack, SQL injections. The proposed system is intrusion detection system which detects for various failures and attacks in the given network data. It uses ML algorithm, for detection of the various attacks and provides the result as the same. The model has been evaluated on dataset collected through network simulations and various data collected from the online sources. The proposed system make sure the system is able to detect the intrusions effectively.KeywordsNetwork securityCyber-physical systemMachine learningNetwork attackIntrusion detection