Real-Time Detection of Invisible Spreaders

The Internet is the darling of the information age. Its rapid development has brought a lot of wealth to the society, but it has also brought about increasingly serious security problems. In particular, the widespread application of e-commerce has made network security the most important part of the development of network technology. Network security technology is increasingly valued by computer researchers. Most of the existing security products are passive. The firewall can only be statically disabled. Although the Intrusion Detection System can dynamically detect the intrusion behavior, it cannot block the detected attack behavior. However, the impact of the intrusion prevention system on network performance and the high intrusion detection false alarm rate restrict the development and application of the IPS system. Especially on gigabit high-speed networks, performance has become the primary bottleneck of IPS systems. In view of the above problems, this paper proposes a distributed intrusion detection and blocking system that can run efficiently on high-speed networks. Such systems are also known as intrusion prevention systems IPS. Explain the structure of distributed high-speed network intrusion prevention system, and also introduce the related implementation technology and the realization of each part of distributed intrusion prevention system.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Chapter 5 - Intrusion Prevention and Detection Systems

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

With the expansion of the campus scope and the application function of campus network, the network flow is also increase, which requires the intrusion detection system can be rapid in the high-speed network, and reduce the misinformation and missed samples of intrusion detection. Therefore, this project aims to security issues of campus. Firstly, the application on the role of the campus network is analyzed, focusing on the system architecture of Snort intrusion detection system, the testing procedures and testing rules etc. The distributed intrusion detection system is combined; the distributed Snort intrusion detection system model is designed through the protocol analysis and pattern matching detection methods to improve the speed and accuracy of the intrusion detection system. Finally, the security of campus network is effectively improved on the application.

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

Attack-aware Security Function Management

Systems employing the Internet and Voice over Internet Protocol (VoIP) are alternative to the legacy landline telephony system. The services offered by these systems allow users to communicate with their family members, friends, banks and business partners whenever they are online. Particularly, the VoIP service is popular with the Internet users because charges are bound into usually fixed access costs making the price of the long distance calls themselves appear economical and even free. However, VoIP services have several disadvantages. One of the disadvantages of VoIP is, it is exposed to Internet security vulnerabilities, threats and attacks. The attacks come in many forms. One of the methods to attack the VoIP service, is by sending a Spam over Internet Telephony (SPIT). SPIT is normally executed by malicious parties initiating automated, unsolicited, and unwanted communications that used VoIP or video conferencing services, just like an email SPAM. Solutions to mitigate SPIT are still lacking. To defense a VoIP system from SPIT, we have come out with the idea of Automated Intrusion Detection and Prevention System over SPIT (AIDPoS) that can detect and prevent SPIT from external parties to enter the VoIP network. AIDPoS is a combination system of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) on Voice over IP (VoIP) server. This is an experimental research to find a solution to combat SPIT if it happens in the future. Our result shows that an automated Intrusion detection and Prevention system over SPIT attack is feasible. Our work is on an open source VoIP network. Other vulnerabilities and threats are important, but beyond our research scope and is not covered in this paper.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

With the rapid development of machine learning and Internet technology, the combination of the two methods is well appreciated recently.An anomaly and intrusion detection system is a mechanism that monitors network or system activities for malicious activities.Intrusion detection and prevention systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts.As far as other usages of Intrusion detection and prevention systems are concerned, such as identifying problems with security policies and deterring individuals from violating security policies.Anomaly detection systems are becoming an important addition to the security infrastructure of nearly every organization.In this paper, we propose a novel mechanism for real-world traffic and research there cases with theoretical analysis.

Intrusion Detection Systems (IDS) play a crucial role in network security. An IDS recognizes malicious activity in network traffic by matching it against patterns defined in a set of rules. The complexity and size of rule sets lead to substantial computational load. In a state-of-the-art IDS, such as Suricata, a single CPU core processes a few hundred MB to a few GB of network traffic per second, and rule evaluation accounts for over 60% of CPU consumption. Scaling IDS to today's high-speed networks is, therefore, a significant challenge.

In order to solve the problem of low intrusion detection rate and weak generalization ability of Intrusion Detection System (IDS), it proposes a new hybrid method based on the relationship of feature and spatial correlation for IDS. The proposed IDS reduces the dimension of network data flow by spatial correlation-based dimension reduction method (SCDR). It improves the effectiveness of intrusion detection, and the negative feedback learning method can also improve the generalization ability of IDS. Experiments show that the method in this paper can improve the detection rate notably and also enhance the detection ability of unknown attacks.

Intrusion detection is an emerging area of research in the computer security and net-works with the growing usage of internet in everyday life. Most intrusion detection systems (IDSs) mostly use a single classifier algorithm to classify the network traffic data as normal behavior or anomalous. However, these single classifier systems fail to provide the best possible attack detection rate with low false alarm rate. In this paper,we propose to use a hybrid intelligent approach using a combination of classifiers in order to make the decision intelligently, so that the overall performance of the resul-tant model is enhanced. The general procedure in this is to follow the supervised or un-supervised data filtering with classifier or cluster first on the whole training dataset and then the output are applied to another classifier to classify the data. In this re- search, we applied Neural Network with Supervised and Unsupervised Learning in order to implement the intrusion detection system. Moreover, in this project, we used the method of Parallelization with real time application of the system processors to detect the systems intrusions.Using this method enhanced the speed of the intrusion detection. In order to train and test the neural network, NSLKDD database was used. Creating some different intrusion detection systems, each of which considered as a single agent, we precisely proceeded with the signature-based intrusion detection of the network.In the proposed design, the attacks have been classified into 4 groups and each group is detected by an Agent equipped with intrusion detection system (IDS).These agents act independently and report the intrusion or non-intrusion in the system; the results achieved by the agents will be studied in the Final Analyst and at last the analyst reports that whether there has been an intrusion in the system or not. Keywords: Intrusion Detection, Multi-layer Perceptron, False Positives, Signature- based intrusion detection, Decision tree, Nave Bayes Classifier

The problem of intrusion detection in the computer networks is not new and various methodologies have been formulated to address the same. A game-theoretic representation was also formulated, using one of the oldest game playing techniques, the minimax algorithm to solve this problem. It exploited the adversary like situation between the intruder and the Intrusion Detection System (IDS) and the essence of this approach lies in the assumption that the intruder and the IDS have complete knowledge of the network and each other’s strategy. The solution for the intrusion detection problem via game theory gives the detection probability by which the IDS can detect the malicious packets on a given network when the probabilities with which the intruder sends the malicious packets on the various paths leading him to the target are known to the IDS. However, in the real world scenario, the role of the intruder and the IDS is dynamic, if the attack is detected or goes undetected the intruder tries to breach the network again with a different approach or the IDS tries to defend the network with a different strategy respectively. The next strategy for either of the two can be learnt by experience and thus, this paper, models an artificial neural network to represent this game-theoretic representation. The modeled neural network gives the detection probability of an attack by the IDS when the probabilities of sending malicious packets on the various paths leading the intruder to the target are given as an input pattern to the neural network.