SparseIDS: Learning Packet Sampling with Reinforcement Learning

Intrusion detection system plays an important role in ensuring information security, and the key technology is to accurately identify various attacks in the network. Due to huge increase in network traffic and different types of attacks, accurately classifying the malicious and legitimate network traffic is time consuming and computational intensive. Recently, more and more researchers applied deep neural networks (DNNs) to solve intrusion detection problems. Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN), the two main types of DNN architectures, are widely explored to enhance the performance of intrusion detection system. In this paper, we made a systematic comparison of CNN and RNN on the deep learning based intrusion detection systems, aiming to give basic guidance for DNN selection.

Intrusion Detection Systems (IDS) is one of the important aspects of cyber security that can detect the anomalies in the network traffic. IDS are a part of Second defense line of a system that can be deployed along with other security measures such as access control, authentication mechanisms and encryption techniques to secure the systems against cyber-attacks. However, IDS suffers from the problem of handling large volume of data and in detecting zero-day attacks (new types of attacks) in a real-time traffic environment. To overcome this problem, an intelligent Deep Learning approach for Intrusion Detection is proposed based on Convolutional Neural Network (CNN-IDS). Initially, the model is trained and tested under a new real-time traffic dataset, CSE-CIC-IDS 2018 dataset. Then, the performance of CNN-IDS model is studied based on three important performance metrics namely, accuracy / training time, detection rate and false alarm rate. Finally, the experimental results are compared with those of various Deep Discriminative models including Recurrent Neural network (RNN), Deep Neural Network (DNN) etc., proposed for IDS under the same dataset. The Comparative results show that the proposed CNN-IDS model is very much suitable for modelling a classification model both in terms of binary and multi-class classification with higher detection rate, accuracy, and lower false alarm rate. The CNN-IDS model improves the accuracy of intrusion detection and provides a new research method for intrusion detection.

Various Internet solutions take their power processing and analysis from cloud computing services. Internet of Things (IoT) applications started discovering the benefits of computing, processing, and analysis on the device itself aiming to reduce latency for time-critical applications. However, on-device processing is not suitable for resource-constraints IoT devices. Edge computing (EC) came as an alternative solution that tends to move services and computation more closer to consumers, at the edge. In this letter, we study and discuss the applicability of merging deep learning (DL) models, i.e., convolutional neural network (CNN), recurrent neural network (RNN), and reinforcement learning (RL), with IoT and information-centric networking which is a promising future Internet architecture, combined all together with the EC concept. Therefore, a CNN model can be used in the IoT area to exploit reliably data from a complex environment. Moreover, RL and RNN have been recently integrated into IoT, which can be used to take the multi-modality of data in real-time applications into account.

Головною концепцією і предметом дослідження є виявлення різного типу обширних атак в інфраструктурі IoT, огляд представленої моделі, методів та існуючих передових систем виявлення вторгнень. Метою даної роботи є запропонування системи виявлення вторгнень в режимі реального часу, яка буде навчена на наборі з великим обсягом даних, за допомогою нейронної мережі з використанням ансамблевого методу машинного навчання. Предметом дослідження є огляд існуючих методів та моделей виявлення широкомасштабної атаки та запропонування власного рішення системи виявлення вторгнень, яка буде базуватися на методі виявлення аномалій та нейронної мережі. Висновок. Побудована система виявлення вторгнень, яка аналізує інтернет трафік, вилучає ознаки з пакету, обробляє їх та передбачує різні види атак, а також характеризує їх за типом. Загрозу безпеці можна вважати основною критичною проблемою для пристроїв IoT, тому використання таких систем зменшує ризики втрати даних.

Internet of Things (IoT) technology has been incorporated into the majority of people’s everyday lives and places of employment due to the quick development in information technology. Modern agricultural techniques increasingly use the well-known and superior approach of managing a farm known as “smart farming”. Utilizing a variety of information and agricultural technologies, crops are observed for their general health and productivity. This requires monitoring the condition of field crops and looking at many other indicators. The goal of smart agriculture is to reduce the amount of money spent on agricultural inputs while keeping the quality of the final product constant. The Internet of Things (IoT) has made smart agriculture possible through data collection and storage techniques. For example, modern irrigation systems use effective sensor networks to collect field data for the best plant irrigation. Smart agriculture will become more susceptible to cyber-attacks as its reliance on the IoT ecosystem grows, because IoT networks have a large number of nodes but limited resources, which makes security a difficult issue. Hence, it is crucial to have an intrusion detection system (IDS) that can address such challenges. In this manuscript, an IoT-based privacy-preserving anomaly detection model for smart agriculture has been proposed. The motivation behind this work is twofold. Firstly, ensuring data privacy in IoT-based agriculture is of the utmost importance due to the large volumes of sensitive information collected by IoT devices, including on environmental conditions, crop health, and resource utilization data. Secondly, the timely detection of anomalies in smart agriculture systems is critical to enable proactive interventions, such as preventing crop damage, optimizing resource allocation, and ensuring sustainable farming practices. In this paper, we propose a privacy-encoding-based enhanced deep learning framework for the difficulty of data encryption and intrusion detection. In terms of data encoding, a novel method of a sparse capsule-auto encoder (SCAE) is proposed along with feature selection, feature mapping, and feature normalization. An SCAE is used to convert information into a new encrypted format in order to prevent deduction attacks. An attention-based gated recurrent unit neural network model is proposed to detect the intrusion. An AGRU is an advanced version of a GRU which is enhanced by an attention mechanism. In the results section, the proposed model is compared with existing deep learning models using two public datasets. Parameters such as recall, precision, accuracy, and F1-score are considered. The proposed model has accuracy, recall, precision, and F1-score of 99.9%, 99.7%, 99.9%, and 99.8%, respectively. The proposed method is compared using a variety of machine learning techniques such as the deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), and long short-term memory (LSTM).

The rapid evolution of next-generation networks (NGNs), driven by 5G, IoT, edge computing, and software-defined networking, has introduced new opportunities alongside complex security challenges. Traditional intrusion detection and prevention systems (IDS), built on signature-based and anomaly-based methods, struggle to cope with the scale, heterogeneity, and dynamic threat landscape of NGNs. In response, artificial intelligence (AI) has emerged as a powerful enabler of modern IDPS. This review surveys AI-powered approaches, beginning with classical machine learning methods such as decision trees, support vector machines, and random forests, and then examining deep learning architectures including convolutional neural networks (CNNs), recurrent neural networks (RNNs), long short-term memory networks (LSTMs), and autoencoders. It further analyses hybrid frameworks that integrate ensemble learning, federated learning, and meta-learning, as well as specialised methods tailored for SDN, IoT, edge, and cloud/5G environments. Benchmark datasets, including NSL-KDD, CICIDS2017, UNSW-NB15, Bot-IoT, IoT-23, and TON_IoT, are reviewed, highlighting their contributions and limitations. The paper identifies key challenges, including dataset scarcity, generalisation gaps, computational overhead, adversarial robustness, explainability, and privacy. Future directions emphasise the need for realistic NGN datasets, lightweight yet accurate architectures, privacy-preserving and federated frameworks, and integrated detection and prevention mechanisms. Overall, AI-powered IDPS demonstrate significant potential to secure NGNs, but realising this vision will require advances that balance accuracy, efficiency, interpretability, and resilience.

The Sixth International Symposium on Neural Networks (ISNN 2009)

The conventional criteria of Intrusion Detection Systems (IDS) need to evolve because they fail to detect modern cyber security threats adequately. The advantages of machine learning (ML) and deep learning (DL) models in IDS functionality are limited by the inability to provide explanations which prevents cybersecurity professionals from validating decisions. The research analyzes DL-based IDS performance and interpretability standards through the examination of the NSL-KDD dataset. A screening process identified models that combined high reliability and accuracy numbers as selection candidates. feedforward neural networks (FNN), convolutional neural networks (CNN), and recurrent neural networks (RNN)—findings revealed that CNN achieved the greatest accuracy of 94.2% along with an AUC of 0.97 exempting FNN (91.3%) and RNN (93.8%). The effective extraction of spatial features from network traffic data by CNN models leads to its higher performance. The "black-box" nature of CNNs within DL models makes them difficult to understand because they remain concealed from users. The research integrated local interpretable model-agnostic explanations (LIME) and Shapley additive explanations (SHAP) to interpret decisions at the feature level. The implemented methods did not result in substantial accuracy improvements yet they made classification decisions more trustworthy and understandable by indicating the important features involved. Furthermore, in these developments there exist technical obstacles associated with high processing expenses and performance versus deployment speed balancing requirements. Research initiatives should focus on developing explainability techniques that maintain high-performance rates and excellent interpretability in IDS systems.

Fault detection in continuous industrial processes is crucial to ensure production, quality, safety, environmental and economic aspects. Reliable fault detection systems have become even more necessary due to increasingly stringent regulations. The complexity of processes, on the one hand, and the availability of data, on the other, have spread the adoption of the data-driven approach for industrial fault detection. Deep Reinforcement Learning (RL) has recently been applied for this purpose, mainly in rotating machinery and rolling bearings. In chemical processes, most RL applications are in process control. The main contribution of this work lies in proposing a reinforcement learning (RL)-based framework for fault detection in continuous chemical processes. The challenges are related to the large number of variables, nonlinear relationships and changing operational dynamics, to name a few. The classic Tennessee Eastman Process (TEP) benchmark was used as a case study. The results were compared with Principal Component Analysis (PCA), commonly used for chemical process monitoring, dynamic PCA (DPCA), and neural networks. Compared to PCA, the RL approach showed considerably lower missed detection rate (MDR) and time to detection (TTD) while maintaining reasonable false alarm rate (FAR) for all hard-to-detect faults, contributing to early fault detectability. Similar results were obtained with regard to DPCA. Compared to the supervised approach, RL proved to be more flexible regarding model parameterization, which can be very useful for practical aspects of industrial fault detection. The results show that RL-based approaches can be very useful for fault detection in continuous, non-linear, and time-varying systems, such as chemical processes. For example, with regard to adaptive alarm thresholds and the detection of known and unknown faults. The latter represents a major challenge in industrial practice.

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

Attack-aware Security Function Management

The main intention of edge computing is to improve network performance by storing and computing data at the edge of the network near the end user. However, its rapid development largely ignores security threats in large-scale computing platforms and their capable applications. Therefore, Security and privacy are crucial need for edge computing and edge computing based environment. Security vulnerabilities in edge computing systems lead to security threats affecting edge computing networks. Therefore, there is a basic need for an intrusion detection system (IDS) designed for edge computing to mitigate security attacks. Due to recent attacks, traditional algorithms may not be possibility for edge computing. This article outlines the latest IDS designed for edge computing and focuses on the corresponding methods, functions and mechanisms. This review also provides deep understanding of emerging security attacks in edge computing. This article proves that although the design and implementation of edge computing IDS have been studied previously, the development of efficient, reliable and powerful IDS for edge computing systems is still a crucial task. At the end of the review, the IDS developed will be introduced as a future prospect.

Strong cybersecurity safeguards are increasingly necessary as the digital landscape changes to protect sensitive data and vital infrastructure. To detect and reduce any risks to network security, intrusion detection systems, or IDS, are essential. To improve the precision and effectiveness of anomaly detection, this paper suggests a novel method of intrusion detection that makes use of recurrent neural networks (RNNs). Standard intrusion detection systems (IDS) frequently depend on static rule-based systems, which may find it difficult to adjust to changing and dynamic cyber threats. On the other hand, sequence-retention neural networks, or RNNs, they have a special capacity to recognize patterns and temporal connections in sequential input. Traditional IDS methods are contrasted with the suggested system, which is assessed using common datasets. The RNN-based IDS is successful at detecting known and unknown threats while reducing false positives, according to preliminary data.

Recently, there is great interest to investigate the application of deep learning models for the prediction of clinical events using electronic health records (EHR) data. In EHR data, a patient's history is often represented as a sequence of visits, and each visit contains multiple events. As a result, deep learning models developed for sequence modeling, like recurrent neural networks (RNNs) are common architecture for EHR-based clinical events predictive models. While a large variety of RNN models were proposed in the literature, it is unclear if complex architecture innovations will offer superior predictive performance. In order to move this field forward, a rigorous evaluation of various methods is needed. In this study, we conducted a thorough benchmark of RNN architectures in modeling EHR data. We used two prediction tasks: the risk for developing heart failure and the risk of early readmission for inpatient hospitalization. We found that simple gated RNN models, including GRUs and LSTMs, often offer competitive results when properly tuned with Bayesian Optimization, which is in line with similar to findings in the natural language processing (NLP) domain. For reproducibility, Our codebase is shared at https://github.com/ZhiGroup/pytorch_ehr.

Reinforcement learning (RL) models are used extensively to study human behavior. These rely on normative models of behavior and stress interpretability over predictive capabilities. More recently, neural network models have emerged as a descriptive modeling paradigm that is capable of high predictive power yet with limited interpretability. Here, we seek to augment the expressiveness of theoretical RL models with the high flexibility and predictive power of neural networks. We introduce a novel framework, which we term theoretical-RNN (t-RNN), whereby a recurrent neural network is trained to predict trial-by-trial behavior and to infer theoretical RL parameters using artificial data of RL agents performing a two-armed bandit task. In three studies, we then examined the use of our approach to dynamically predict unseen behavior along with time-varying theoretical RL parameters. We first validate our approach using synthetic data with known RL parameters. Next, as a proof-of-concept, we applied our framework to two independent datasets of humans performing the same task. In the first dataset, we describe differences in theoretical RL parameters dynamic among clinical psychiatric vs. healthy controls. In the second dataset, we show that the exploration strategies of humans varied dynamically in response to task phase and difficulty. For all analyses, we found better performance in the prediction of actions for t-RNN compared to the stationary maximum-likelihood RL method. We discuss the use of neural networks to facilitate the estimation of latent RL parameters underlying choice behavior.