Reducing false positives in intrusion detection systems using data-mining techniques utilizing support vector machines, decision trees, and naive Bayes for off-line analysis

An Efficient Cyber Assault Detection System using Feature Optimization for IoT-based Cyberspace

Intrusion Detection Systems (IDS) are vital for securing cloud environments, where dynamic scalability and distributed architecture present significant security challenges. Accurate, real-time threat detection with minimal false positives is essential for effective cloud protection. Traditional machine learning models such as Support Vector Machines (SVM) and Random Forests have been applied in IDS but often struggle with high false positive rates and limited effectiveness against novel or zero-day attacks. A deep neural network (DNN) architecture is designed, incorporating multiple ReLU-activated hidden layers and dropout layers to prevent overfitting. The model is trained using the Adam optimizer and categorical cross-entropy loss to ensure efficient learning and responsiveness. Evaluation on NSL-KDD and CICIDS2017 datasets demonstrates high detection accuracy—98.7% and 97.4% respectively—along with reduced false positive rates and promising results in identifying zero-day attacks during simulation. Future work includes integrating federated learning to support distributed deployment and enhance privacy preservation.

With the wide application of information technolo-gies in communication based train control (CB TC) systems, the information security risks it confronts to are ever increasing. It is very difficult to design an intrusion detection system (IDS) which can detect both known and unknown cyber attacks with high true positive rate (TPR) and low false positive rate (FPR), simultaneously. In this paper, we propose a hybrid intrusion detection system (RIDS) which is composed of a signature-based intrusion detection system (SIDS) and an anomaly-based intrusion detection system (AIDS). An improved stacking ensemble algorithm (ISEA) is proposed to enhance the TPR of the SIDS which uses weighted classification probabilities outputted by base-classifiers to generate meta-features for the meta-classifier. The FPR of the AIDS is significantly reduced through adopting the proposed false positive elimination strategy (FPES). In addition, a Bayesian optimization algorithm is used for hyper-parameters adjustment to optimize the overall performance of the RIDS. The proposed RIDS is evaluated using both a KDD99 dataset and a CBTC dataset collected on a hardware-in-the-Ioop simulation platform. For the KDD99 dataset, the TPR and FPR of the proposed RIDS are 98.6% and 1.3%, respectively. For the CBTC dataset, the TPR and FPR are 98.1% and 1.1 %, respectively. Based on the performance comparison among different RIDSs, it is can be concluded that the proposed RIDS is superior to the existing RIDS in both TPR and FPR.

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.

Computer networks are being attacked every day. Intrusion detection systems (IDS) are used to detect and reduce effects of these attacks. The currently used of hybrid intrusion detection systems that was base on signature and anomaly based detection techniques were became inefficient for detecting attacks because it have nearly less than or equal to 95.5% for the detection rate and 1.8% for false positive rate, nowadays these values are unsatisfied for the detection so that the needs to enhanced hybrid intrusion detection system has became the most important issues. In this study, the enhanced hybrid intrusion detection system has been proposed to provide better results with high accuracy of the detection rate and reduce the value of false positive rate that will done by proposing new method based on decision tree of data mining techniques that is based on C4.5 algorithm to show that the proposed model is more efficient and it gives better optimum results.

The study aims to address critical challenges in network security, particularly the limitations of traditional intrusion detection systems (IDS) in terms of adaptability, detection precision, and high false positive rates in dynamic network environments. A novel hybrid IDS model integrating the Flower Pollination Algorithm (FPA), Cheetah Optimization Algorithm (COA), and Artificial Neural Networks (ANN) is proposed to enhance detection accuracy, reduce false positives, and optimize feature selection, anomaly detection, and rule adaptation. The hybrid FPA-COA-ANN model combines the optimization capabilities of FPA and COA with the predictive power of ANN. The model was evaluated using five benchmark datasets—CICIDS-2017, TII-SSRC, Lu-flow, NSL-KDD, and WSN-DS. Key performance metrics were analysed to assess the model’s effectiveness in detecting malicious activities in complex network traffic patterns. The hybrid model demonstrated superior performance compared to existing IDS approaches. It achieved accuracy rates of 0.99 on CICIDS-2017, 1.00 on TII-SSRC, 1.00 on Lu-flow, 0.99 on NSL-KDD, and 0.93 on WSN-DS. The results highlight significant improvements in detection precision and adaptability, alongside a reduction in false positive rates, showcasing the model’s robustness and scalability for real-time threat detection. The proposed hybrid FPA-COA-ANN model effectively mitigates the limitations of traditional IDS by offering a robust, scalable, and efficient solution for real-time network threat detection. Its high accuracy and adaptability across diverse benchmark datasets underscore its potential as a critical tool for enhancing cybersecurity defences in dynamic and complex environments.

Cyberspace is a concept describing a widespread, interconnected digital technology with numerous users. New standards add more concerns with tremendous information gathered from various network sources, which can be utilized for focused cyber-attacks. Digital attacks in networks are getting more complex and subsequently introducing expanding difficulties in precisely distinguishing network intrusions. Inability to forestall the network intrusions could debase the validity of safety administrations, for example, information privacy, trustworthiness, and accessibility. In this work, we center around developing a Network Intrusion Detection System which is implemented utilizing Machine Learning Techniques. IDS dependent on ML techniques are successful and exact in distinguishing varied networks intrusions. Also, many of the ML-based IDS experience the ill effects of an increment in false-positive rate, leading to lower precision and accuracy. Consequently, we present an exploration of the UNSW-NB15 intrusion detection dataset that will be utilized for preparing the machine learning models. In our tests, we carry out various ML approaches namely, Support Vector Machine (SVM), Logistic Regression (LR), Random Forest Classifier (RF), Decision Tree (DT), Gradient boosted decision trees (GBDT). The results demonstrated that the hyperparameter optimization technique using Grid Search and Random Search methods and evaluation using k-fold cross-validation gives better optimization of model parameters and henceforth brings about better execution.KeywordsCross-validationCyberattackDecision tree (DT)Gradient boosted decision trees (GBDT)Hyperparameter TuningLogistic regression (LR)Network intrusion detection system (IDS)Random forest classifier (RF)Support vector machine (SVM)

Portable Document Format (PDF) is one of the widely-accepted document format. However, it becomes one of the most attractive targets for exploitation by malware developers and vulnerability researchers. Malicious PDF files can be used in Advanced Persistent Threats (APTs) targeting individuals, governments, and financial sectors. The existing tools such as intrusion detection systems (IDSs) and antivirus packages are inefficient to mitigate this kind of attacks. This is because these techniques need regular updates with the new malicious PDF files which are increasing every day. In this paper, a new algorithm is presented for detecting malicious PDF files based on data mining techniques. The proposed algorithm consists of feature selection stage and classification stage. The feature selection stage is used to the select the optimum number of features extracted from the PDF file to achieve high detection rate and low false positive rate with small computational overhead. Experimental results show that the proposed algorithm can achieve 99.77% detection rate, 99.84% accuracy, and 0.05% false positive rate.

Data security is regarded to be one of the crucial challenges in this fast-growing internet world. Data generated through internet is exposed to various types of vulnerabilities and exploits. Security mechanisms such as Intrusion Detection System (IDS) are designed to detect various types of vulnerabilities and attacks. Various Machine Learning (ML) and Deep Learning (DL) techniques are used for building IDS. In this paper, we aim to build Deep Neural Network (DNN)-based IDS for attack detection and classification. DNN technique has certain challenges such as complex network structure, co-adaptation of feature vectors, over-fitting, to name a few. We aim to address these challenges by using AntiRectifier layer and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian Noise. In this paper, we have evaluated DNN-based IDS using NSL-KDD, UNSW_NB-15 and CIC-IDS-2017 dataset. The experimental results show that DNN-based IDS with AntiRectifier layer outperforms compared to ML techniques such as Decision Tree (DT), Random Forest (RF), Naïve Bayes (NB), Support Vector Machine (SVM), k-Nearest Neighbours (k-NN) and variants of dropout namely, Standard dropout, Gaussian dropout, and Gaussian noise in terms of accuracy, precision, recall, f-score, and false positive rate.

Todays, Intrusion Detection Systems (IDS) are considered as key components of security networks. However, high false positive and false negative rates are the important problems of these systems. On the other hand, many of the existing solutions in the articles are restricted to class datasets due to the use of a specific technique, but in real applications they may have multi-variant datasets. With the impetus of the facts, this paper presents a new anomaly based intrusion detection system using J48 Decision Tree, Support Vector Classifier (SVC) and k-means clustering algorithm in order to reduce false alarm rates and enhance the system performance. J48 decision tree algorithm is used to select the best features and optimize the dataset. Also, an SVM classifier and a modified k-means clustering algorithm are used to build a profile of normal and anomalous behaviors of dataset. Simulation results on benchmark NSL-KDD, CICIDS2017 and synthetic datasets confirm that the proposed method has significant performance in comparison with previous approaches.

Various machine-learning methods have been applied to anomaly intrusion detection. However, the Intrusion Detection System still faces challenges in improving Detection Rate and reducing False Positive Rate. In this paper, a Class-Level Soft-Voting Ensemble (CLSVE) scheme based on the Chaos Bat Algorithm (CBA), called CBA-CLSVE, is proposed for intrusion detection. The Support Vector Machine (SVM), K-Nearest Neighbor (KNN) and Decision Tree (DT) are selected as the base learners of the ensemble. The Chaos Bat Algorithm is used to generate class-level weights to create the weighted voting ensemble. A weighted fitness function considering the tradeoff between maximizing Detection Rate and minimizing False Positive Rate is proposed. In the experiments, the NSL-KDD, UNSW-NB15 and CICIDS2017 datasets are used to verify the scheme. The experimental results show that the class-level weights generated by CBA can be used to improve the combinative performance. They also show that the same ensemble performance can be achieved using about half the total number of features or fewer.

In the fast-changing era of data communication, cyber-attacks and unauthorized access pose a significant threat to system and network security. Conventional Intrusion Detection Systems (IDS) are plagued by low accuracy and high false positives, which erode their usefulness in real-time intrusion detection. To overcome this issue, a new hybrid approach is proposed where Rough Set Theory (RST) is used for feature selection and Support Vector Machine (SVM) for classification. The main aim is to improve the detection accuracy while, at the same time, minimizing the complexity and dimensionality of data and processing. RST successfully filters out the most important features from the network traffic data and eliminates redundant or irrelevant attributes before forwarding the pre-processed data to the SVM classifier. This, besides lowering the processing complexity, also enhances the classification performance. The novelty lies in the combined application of RST and SVM, hence offering a more efficient alternative to existing methods like Principal Component Analysis (PCA). The proposed IDS exhibits enhanced detection accuracy with an appreciable reduction in false positives, hence offering a more efficient and reliable intrusion detection mechanism.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

The study examined the detection of attacks against computer networks, which is becoming a harder problem to solve in the field of Network security. A problem with current intrusion detection systems is that they have many false positive and false negative events. Most of the existing Intrusion detection systems implemented depend on rule-based expert systems where new attacks are not detectable. In this study, optimization algorithms were added to intrusion detection system to make them more efficient. Self Organizing Migrating Genetic Algorithm (SOMGA) was integrated into intrusion detection system to obtain a more efficient intrusion detection system called ID-SOMGA. This study provides an equally efficient method to implement an intrusion detection system that returns very low false positives. Due to the complexities involved in security issues, and the implementation of the work, selected values of the network log was used to implement the system in order to reduce some of these complexities. The Self Organizing Migrating Genetic Algorithm – Intrusion Detection System was tested and values of the result were compared with that of an IDS with Genetic Algorithm Intrusion Detection System. In terms of detection rates, ID-SOMGA was found to be slower than an IDS with GA, the false positives in ID-SOMGA was lower than what obtains with genetic algorithm. Both schemes were able to identify new patterns almost in the same way. The ID-SOMGA system that was developed improved the security of systems in networked settings allowing for confidentiality, integrity and availability of system resources.

Network security is one of the important issues that should be handled carefully and security to our data and important information is necessary when communicating with outside world over the internet. We have so many examples of the attacks that have been happened in the past and threatened a huge loss to the world. Over the years, a lot of work is done in this area and many security systems are developed, many security algorithms are implemented which have strong security fundamentals. Also, these systems have proven strong at the time of highly insecurity incidences or attacks. But, the problem is still there in identifying the malicious node entry in the network correctly without any false positives or false negatives, also within quick time before getting any type of access to the network by such malicious nodes which are also called as intruders. We need a system which should be operating faster even in heavy incoming network traffic scenarios, and generating correct identification of the intruders as well as giving easy, faster network access to non intruders or normal connecting nodes by correctly identifying them as normal nodes. In this research work, we are carrying out the implementation of the Intrusion detection System (IDS) model which performs faster as well as classifies the communicating nodes correctly as intruder or normal user. This IDS model is being implemented in two phases, hence a Two Phase Intrusion Detection System, abbreviated and named as TP-IDS model. We are using the machine learning techniques to develop this model, which makes this model a strongly secure IDS model and helping to better identify the known as well as unkown attack. We are using first phase for the identification and second phase for the validation of the first phase results of our model, which provides high accuracy. In first phase of the IDS we are using Support Vector Machine (SVM), k Nearest Neighbor (kNN) and in second phase we are using Decision Tree (DT), Naive Bayes (NB) for first phase validation. Also, the issue of efficiency is handled by underlying data processing infrastructure, which is HADOOP that increases efficiency or speed of the TP-IDS.