Optimal Evaluation of Feature Selection in Intrusion Detection Modeling

Accurate intrusion detection is necessary to preserve network security. However, developing efficient intrusion detection system is a complex problem due to the nonlinear nature of the intrusion attempts, the unpredictable behaviour of network traffic, and the large number features in the problem space. Hence, selecting the most effective and discriminating feature is highly important. Additionally, eliminating irrelevant features can improve the detection accuracy as well as reduce the learning time of machine learning algorithms. However, feature reduction is an NPhard problem. Therefore, several metaheuristics have been employed to determine the most effective feature subset within reasonable time. In this paper, two intrusion detection models are built based on a modified version of the firefly algorithm to achieve the feature selection task. The first and, the second models have been used for binary and multiclass classification, respectively. The modified firefly algorithm employed a mutation operation to avoid trapping into local optima through enhancing the exploration capabilities of the original firefly. The significance of the selected features is evaluated using a Naïve Bayes classifier over a benchmark standard dataset, which contains different types of attacks. The obtained results revealed the superiority of the modified firefly algorithm against the original firefly algorithm in terms of the classification accuracy and the number of selected features under different scenarios. Additionally, the results assured the superiority of the proposed intrusion detection system against other recently proposed systems in both binary classification and multi-classification scenarios. The proposed system has 96.51% and 96.942% detection accuracy in binary classification and multi-classification, respectively. Moreover, the proposed system reduced the number of attributes from 41 to 9 for binary classification and to 10 for multi-classification.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

To explore the advantages of adversarial learning and deep learning, we propose a novel network intrusion detection model called SAVAER-DNN, which can not only detect known and unknown attacks but also improve the detection rate of low-frequent attacks. SAVAER is a supervised variational auto-encoder with regularization, which uses WGAN-GP instead of the vanilla GAN to learn the latent distribution of the original data. SAVAER's decoder is used to synthesize samples of low-frequent and unknown attacks, thereby increasing the diversity of training samples and balancing the training data set. SAVAER's encoder is used to initialize the weights of the hidden layers of the DNN and explore high-level feature representations of the original samples. The benchmark NSL-KDD (KDDTest+), NSL-KDD (KDDTest-21) and UNSW-NB15 datasets are used to evaluate the performance of the proposed model. The experimental results show that the proposed SAVAER-DNN is more suitable for data augmentation than the other three well-known data oversampling methods. Moreover, the proposed SAVAER-DNN outperforms eight well-known classification models in detection performance and is more effective in detecting low-frequent and unknown attacks. Furthermore, compared with other state-of-the-art intrusion detection models reported in the IDS literature, the proposed SAVAER-DNN offers better performance in terms of overall accuracy, detection rate, F1 score, and false positive rate.

With the advent of the Internet of Things (IoT), the security of the network layer in the IoT is getting more and more attention. The traditional intrusion detection technologies cannot be well adapted in the complex Internet environment of IoT. For the deep learning algorithm of intrusion detection, a neural network structure may have fine detection accuracy for one kind of attack, but it may not have a good detection effect when facing other attacks. Therefore, it is urgent to design a self-adaptive model to change the network structure for different attack types. This paper presents an intrusion detection model based on improved genetic algorithm (GA) and deep belief network (DBN). Facing different types of attacks, through multiple iterations of the GA, the optimal number of hidden layers and number of neurons in each layer are generated adaptively, so that the intrusion detection model based on the DBN achieves a high detection rate with a compact structure. Finally, the NSL-KDD dataset was used to simulate and evaluate the model and algorithms. The experimental results show that the improved intrusion detection model combined with DBN can effectively improve the recognition rate of intrusion attacks and reduce the complexity of the neural network structure.

Advancements in machine learning and artificial intelligence have been widely utilised in the security domain, including but not limited to intrusion detection techniques. With the large training datasets of modern traffic, intelligent algorithms and powerful machine learning tools, security researchers have been able to greatly improve on the intrusion detection models and enhance their ability to detect malicious traffic more accurately. Nonetheless, the problem of detecting completely unknown security attacks is still an open area of research. The enormous number of newly developed attacks constitutes an eccentric challenge for all types of intrusion detection systems. Additionally, the lack of a standard definition of what constitutes an unknown security attack in the literature and the industry alike adds to the problem. In this paper, the researchers reviewed the studies on detecting unknown attacks over the past 10 years and found that they tended to use inconsistent definitions. This formulates the need for a standard consistent definition to have comparable results. The researchers proposed a new categorisation of two types of unknown attacks, namely Type-A, which represents a completely new category of unknown attacks, and Type-B, which represents unknown attacks within already known categories of attacks. The researchers conducted several experiments and evaluated modern intrusion detection systems based on shallow and deep artificial neural network models and their ability to detect Type-A and Type-B attacks using two well-known benchmark datasets for network intrusion detection. The research problem was studied as both a binary and multi-class classification problem. The results showed that the evaluated models had poor overall generalisation error measures, where the classification error rate in detecting several types of unknown attacks from 92 experiments was 50.09%, which highlights the need for new approaches and techniques to address this problem.

The rapid expansion of the Internet of Things (IoT) and Big Data (BD) has led to security challenges. Securing IoT-BD against cyberattacks is necessary. An increasing number of applications are being implemented on BD platforms due to the rapid proliferation of data on the Internet. As the volume of data increases, the possibility of intrusions on the platform correspondingly increases. Conventional Intrusion Detection Systems (IDS) are ineffective for managing the extensive volume of historical data and unable to fulfil the security demands of BD platforms. This research aims to propose a novel intrusion detection model using Binary Sand Cat Swarm Optimization and Spatiotemporal Transformer Neural Network (BSCSO-STNN) model to address these issues. The CIC-IoT-23 and Bot-IoT datasets are collected and applied to train the model for evaluation. The developed BSCSO-STNN model is deployed in an Apache Spark (APS) framework. The datasets are initially preprocessed in this framework with data cleaning, oversampling, label encoding, and normalization. After preprocessing, the data is applied to the BSCSO for feature selection. Using the selected features, the STNN model performs binary and multiclass classification for both datasets. The BSCSO-STNN model attained 99.08% accuracy, 98.78% detection rate, 99.02% precision, and 98.94% F1-score using the CIC-IoT-23 dataset. The model attained 99.04% accuracy, 98.81% detection rate, 98.97% precision, and 98.95% F1-score for the BoT-IoT dataset in multiclass classification. The developed model outperformed all the current models in this research and demonstrated its accuracy in detecting intrusions.

In recent years, intelligent intrusion detection techniques based on machine learning have been the research spots in the field of intrusion detection. Whereas, as network traffic and network scale increase continually, some current machine learning algorithms can't meet the requirement of the network intrusion detection models for efficiency and accuracy, which restricts the application of machine learning into intrusion detection. In order to enhance the availability and practicality of intelligent intrusion detection system based on machine learning in high-speed network, an improved fast inductive learning method for intrusion detection (FILMID) is designed and implemented. Accordingly, an efficient intrusion detection model based on FILMID algorithm is presented. The experiment results on the standard testing dataset validate the effectiveness of the FILMID based intrusion detection model.

Exponential growth of novel radical applications and services in sixth-generation (6G) networks is expected to increase the complexity of managing existing network infrastructures. In this context, the zero touch network and service management (ZSM) paradigm, which leverages AI, SDN, and NFV techniques, is seen as a promising solution to automatically manage and orchestrate network resources. However, due to the closed-loop operation and automated end-to-end framework in a distributed 6G network, the ZSM architecture, along with its potential benefits, is exposed to various security threats. A recently proposed solution to address privacy concerns is federated learning (FL), whereby distributed training is performed, and the aggregated model parameters, instead of clients' raw data, are forwarded to the global server. However, most of the existing FL and semi-supervised learning (SSL) models for intrusion detection are based on the assumption that fully labeled data are always available at the server and client sides, which is not practical due to the high labeling costs and privacy constraints in the 6G network. In this article, we propose a novel FL-empowered semi-supervised active learning (FL-SSAL) security orchestration framework for the Label-at-Client scenario where, along with unlabeled samples, clients have a small portion of labeled data. The entropy-based active learning selects the most informative samples for data annotation and leverages the unlabeled data using a semi-supervised approach. The results of our experimental evaluations performed on the private, not independent and identically distributed (non-IID) dataset demonstrate that FL-SSAL achieves higher intrusion detection accuracy and has less communication overhead than baseline schemes with less labeled data.

Intrusion Detection Systems (IDS) play an important role in identifying possible attacks to the networks. Most algorithms create a model; and the classification is done based on that model. During the classification, one of the main concerns is increasing the accuracy and the reliability. Traditional intrusion detection methods have some problems such as high false alarm rate, low detection compatibility against the new attacks, and insufficient capacity of the analysis. The next issue related to the intrusion detection systems is the feature reduction, extraction, and selection. In this paper, an intrusion detection model was created by genetic algorithms (GA) and the construction of the classifying models based on the training data observed from the genetic algorithm by KNN (K-Nearest Neighbors) algorithm has been taken into consideration. In this algorithm, it is supposed to reduce the false alarm rate in comparison with the previous methods.

A lot of intrusion and hacking events are surrounding the internet domain, bringing in a need for security systems. Intrusion detection system (IDS) is employed in the network to identify the attacks by continuously monitoring the system activities. The major issue for any intrusion detection model is to identify anomalies with maximum accuracy and minimal false alarms. An intrusion detection model is developed combining chi-square feature selection and LPBoost algorithm. Chi-square feature selection is deployed to build the optimal features as the network traffic data consists of many attributes. The optimum features are utilised by the LPBoost algorithm for classification of network traffic. An ensemble classifier is chosen as it typically outperforms a single classifier. The experiments are performed using NSL-KDD and UNSW-NB data sets. The results clearly show that the hybrid model achieves a higher detection and reduced false positive rate in contrast to other techniques.

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

The latest response to consumers’ increased demand for accessible genetic health information is the US Food and Drug Administration (FDA)’s recent approval of 23andMe’s direct-to-consumer (DTC) genetic test for the three common BRCA1 and BRCA2 pathogenic variants found in the Ashkenazi Jewish population.1 23andMe and other DTC genetic testing companies officially report out ancestry, trait, and some health information, while also providing consumers with files of their raw genetic data. Up to 62% of consumers use third-party applications to interpret the raw data and health information not included in companies’ reports.2 Little data exists on the nature and prevalence of clinical follow up of third-party raw genetic data interpretation, nor on the psychosocial impact on the consumer and their families.3 This information is of timely importance as a recent study suggests that 40% of genetic variations within DTC raw data sent for clinical confirmation are false positives.4 This raises many questions about the impact of DTC genetic testing and third-party interpretation tools, including the appropriate use of healthcare resources, clinical utility, provider and patient understanding of limitations, and psychological impact on consumers. In this commentary, we present four case vignettes from cardiovascular genetics clinics to bring awareness to possible harms of DTC raw data interpretation. Future studies investigating the breadth and frequency of cases such as these are required to understand the scope of this harm.

Maternal serum markers for trisomy 21 screening (MSS) can be assayed in women > or =35 years in an attempt to reduce the need for invasive procedures and thereby avoid their side effects. Our objective was to compare, in women > or =35, eight different software packages dedicated to second trimester MSS, thus providing reliable data for patient counselling. A simulation study was carried out on 189 sera from women with Down syndrome fetuses and 11 962 sera from mothers of unaffected babies. The first step was to estimate the joint distribution of alpha-fetoprotein (AFP) and free beta-human chorionic gonadotrophin (beta-hCG). The second step was to calculate trisomy 21 detection and false-positive rates for each software according to maternal age (35-45 years), using the usual 1:250 risk threshold. Agreement between software packages was measured using 2 x 2 kappa coefficients. Detection rates and false-positive rates increased with maternal age. Depending on the software, 57-71% detection rates were achieved at 35 years with 12-18% false-positive rates. At 45 years, 61-100% detection rates were achieved with 66-95% false-positive rates. Up to 39 years, all softwares were concordant (kappa coefficients >0.75). In the range 35-45 years, false-positive and detection rates increased substantially with maternal age and differences between software packages are observed.

The rapid growth of cloud computing has led to an increased demand for security mechanisms to safeguard sensitive data and resources from cyber threats. Intrusion detection systems (IDS) play a crucial role in identifying unauthorized access or malicious activities within cloud environments. This paper presents a comparative study of machine learning (ML) techniques used in intrusion detection for cloud computing platforms. Various ML algorithms, including decision trees, support vector machines, k-nearest neighbors, and neural networks, are evaluated based on their performance in detecting different types of attacks. The study assesses the accuracy, efficiency, and scalability of these techniques in cloud environments, highlighting their strengths and limitations. The findings provide valuable insights into the selection of appropriate machine learning models for effective intrusion detection in dynamic and scalable cloud systems.