Self-Adaptive IDS in VANETs: A Game Theory and Deep Q-Learning Network Based Generic Scheme

Vehicular ad hoc networking (VANET) have become a significant technology in the current years because of the emerging generation of self-driving cars such as Google driverless cars. VANET have more vulnerabilities compared to other networks such as wired networks, because these networks are an autonomous collection of mobile vehicles and there is no fixed security infrastructure, no high dynamic topology and the open wireless medium makes them more vulnerable to attacks. It is important to design new approaches and mechanisms to rise the security these networks and protect them from attacks. In this paper, we design an intrusion detection mechanism for the VANETs using Artificial Neural Networks (ANNs) to detect Denial of Service (DoS) attacks. The main role of IDS is to detect the attack using a data generated from the network behavior such as a trace file. The IDSs use the features extracted from the trace file as auditable data. In this paper, we propose anomaly and misuse detection to detect the malicious attack.

Vehicular ad hoc networks (VANETs) are intelligent transport subsystems; vehicles can communicate through a wireless medium in this system. There are many applications of VANETs such as traffic safety and preventing the accident of vehicles. Many attacks affect VANETs communication such as denial of service (DoS) and distributed denial of service (DDoS). In the past few years the number of DoS (denial of service) attacks are increasing, so network security and protection of the communication systems are challenging topics; intrusion detection systems need to be improved to identify these attacks effectively and efficiently. Many researchers are currently interested in enhancing the security of VANETs. Based on intrusion detection systems (IDS), machine learning (ML) techniques were employed to develop high-security capabilities. A massive dataset containing application layer network traffic is deployed for this purpose. Interpretability technique Local interpretable model-agnostic explanations (LIME) technique for better interpretation model functionality and accuracy. Experimental results demonstrate that utilizing a random forest (RF) classifier achieves 100% accuracy, demonstrating its capability to identify intrusion-based threats in a VANET setting. In addition, LIME is applied to the RF machine learning model to explain and interpret the classification, and the performance of machine learning models is evaluated in terms of accuracy, recall, and F1 score.

Chapter 5 - Intrusion Prevention and Detection Systems

A survey on Intrusion Detection Systems and Honeypot based proactive security mechanisms in VANETs and VANET Cloud

Vehicular ad hoc networks (VANETs) incorporating vehicles as an active and fast topology are gaining popularity as wireless communication means in intelligent transportation systems (ITSs). The cybersecurity issue in VANETs has drawn attention due to the potential security threats these networks face. An effective cybersecurity measure is essential as security threats impact the overall system, from business disruptions to data corruption, theft, exposure, and unauthorized network access. Intrusion detection systems (IDSs) are popular cybersecurity measures that detect intrusive behavior in a network. Recently, the machine learning (ML)-based IDS has emerged as a new research direction in VANET security. ML-based IDS studies have focused on improving accuracy as a typical classification task without focusing on malicious data. This study proposes a novel IDS for VANETs that offers more attention to classifying attack cases correctly with minimal features required by applying principal component analysis. The proposed Cascaded ML framework recognizes the difference between the attack and normal cases in the first step and classifies the attack data in the second step. The framework emphasizes that an attack should not be classified into the normal class. Finally, the proposed framework is implemented with an artificial neural network, the most popular ML model, and evaluated with the Car Hacking dataset. In addition, the study also investigates the efficiency of typical classification tasks and compares them with results of the proposed framework. Experimental results on the Car Hacking dataset have revealed the proposed method to be an effective IDS and that it outperformed the existing state-of-the-art ML models.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Vehicular ad hoc network (VANET) is considered as the new generation of wireless ad-hoc network that change our lives. This technology aims to make our lives and roads safer via alert messages exchanged between local vehicles and the road side units (RSU). Unfortunately, the constraints caused by the high mobility, shared wireless medium and the absence of centralized security services offered by dedicated equipment makes the security of the VANET more problematic than any other type of network. Therefore, to ensure the security of this network, several security measures have been developed. Intrusion Detection Systems (IDS) is the most popular. In traditional networks, IDS has already proved its expertise in the detection of unauthorized entry and malicious activity. In vehicular ad hoc networks, IDS are in charge of analyzing incoming and outgoing packets to identify malicious signatures.

One popular solution for reducing the resource consumption of intrusion detection system (IDS) in MANET is to elect a head-cluster (leader) to provide intrusion detection service to other nodes in the same cluster. However, such a moderate mode is only suitable when the probability of attack is low. Once the probability of attack is high, victim nodes should launch their own IDSs to detect and thwart intrusions. Such a robust mode is, however, costly with respect to energy and leads nodes to die faster. Clearly, to reduce the resource consumption of IDSs and yet keep its effectiveness, a critical issue is: when should we shift from moderate to robust mode? In this paper, we formalize this issue as a nonzero-sum noncooperative game theoretical model that takes into consideration the tradeoff between security and IDS resource consumption. The game solution will guide the leader-IDS to find the right moment for notifying the victim node to launch its IDS once the security risk is high enough. To achieve this goal, the Bayesian game theory is used to analyze the interaction between the leader-IDS and intruder with incomplete information about the intruder. By solving such a game, we are able to find the threshold value for notifying the victim node to launch its IDS once the probability of attack exceeds that value. Simulation results show that our scheme can effectively reduce the IDS resource consumption without sacrificing security.

This paper presents Intrusion Detection Systems (IDS), Intrusion Detection and Prevention Systems (IDPS) and their classification emphasizing on the use of neural networks in IDS. Contemporary IDS usually include both signature verification and anomaly detection approaches realized by rule-based expert system and statistical module correspondingly. Neural networks may be used mainly as additional module to the statistical module to better recognize the user behavior. User behavior may be represented as frequency pattern of users command history. The paper presents an example of user profile vector for Unix-based platforms.

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Vehicular Ad hoc Network (VANET) is a component of the Intelligent Transportation System (ITS) which furnishes communication among vehicles. It delivers comfort and safety information to passengers and vehicle drivers. Security plays a vital role during the transmission of data as the various distinct security attacks directly influence the safety of the passengers on the road. Several security attacks will disrupt normal functions like the transmission of data. Some security breaches inject false information which affects the safety of drivers. However, there are several demurrers in detecting abnormal activities efficiently as the traditional system faces imbalanced data problems. This paper presents an Intrusion Detection System (IDS) for detecting anomalies and protecting communication systems from several distinct attacks. The proposed IDS utilizes two deep learning (DL) mechanisms such as Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) for detecting anomalies in the vehicular network. The hybrid CNN-GRU mechanism helps in solving the overfitting and low-velocity problems. It also detects several attacks and protects the ad hoc network from those attacks to safeguard the vehicle users. The results show that the propounded model outperforms the other traditional detection mechanisms by 10.79% in terms of performance compared to other IDS.

Vehicular Ad hoc Networks (VANETs) are the core of Intelligent Transportation Systems (ITS), allowing vehicles to communicate between themselves and with other entities. However, these are very complex networks with volatile architectures, ever-changing members, and multiple types of entities, making them an appealing target for attackers since they can find vulnerabilities and perform attacks with massive impact. The most common security approach is to use traditional tools that can help to prevent attacks. Nonetheless, sometimes attacks cannot be prevented, requiring the use of other tools. Intrusion Detection Systems (IDSs) can detect attacks and trigger a response to minimize their effects. IDSs can take advantage of Machine Learning (ML) algorithms to improve their performance, which are excellent at detecting deviations from patterns. However, these need large sets of data to be trained efficiently, but VANET datasets are a scarce resource. This work aims to evaluate the found publicly available datasets in the context of an IDS for VANETs in three stages: 1) First, evaluate the publicly available VANET datasets and gauge their usability in future works; 2) Then, as the datasets found available to the public are divided depending on the geographic region where they were obtained, assess the advantage of using multiple datasets to train an ML algorithm; 3) Finally, the IDS can be located in different network locations (vehicle, a cluster of vehicles, Road Side Unit (RSU), etc.), which directly influences their performance. The impact of the IDS location in the network is also to be studied. The ML algorithm used is the same across all the experiments, maintaining the same basis for all the tests, with the only variable being the dataset.

The Internet of Things (IoT) has become increasingly popular, and opened new possibilities for applications in various domains. However, the IoT also poses security challenges due to the limited resources of the devices and its dynamic network topology. Routing attacks on 6LoWPAN-based IoT devices can be particularly challenging to detect because of its unique characteristics of the network. In recent years, several techniques have been proposed for detecting routing attacks, including anomaly detection. These techniques leverage different features of network traffic to identify and classify routing attacks. This paper focuses on routing attacks that target the Routing Protocol for Low-Power and Lossy Networks (RPL), which are widely used in 6LoWPAN-based IoT systems. The attacks discussed in this paper can be categorized as either inherited from Wireless Sensor Networks or exploiting vulnerabilities unique to RPL (known as RPL-specific attacks). The paper describes various RPL attacks, including Flood Attacks, Data-DoS/DDoS Attacks, Wormhole Attacks, RPL Rank Attacks, Blackhole Attacks, Version Attacks, and Sinkhole Attacks. In this paper, a novel Hybrid Intrusion Detection System (HIDS) that combines a decision tree classifier and a one-class Support Vector Machine classifier is proposed to detect routing attacks. The HIDS draws on the strengths of both a Signature Intrusion Detection System (SIDS) and an Anomaly-based Intrusion Detection System (AIDS) to identify routing attacks with a high degree of accuracy and a low false alarm rate. The routing dataset, which features genuine IoT network traffic and various kinds of routing attacks, was used to test the proposed HIDS. According to the findings, the hybrid IDS proposed in this study outperforms SIDS and AIDS approaches, with higher detection rates and lower false positive rates.