Storage-Based Intrusion Detection for Storage Area Networks (SANs)

Computer security has become a critical issue with the rapid development of business and other transaction systems over the Internet. The application of artificial intelligence, machine learning and data mining techniques to intrusion detection systems has been increasing recently. But most research is focused on improving the classification performance of a classifier. Selecting important features from input data leads to simplification of the problem, and faster and more accurate detection rates. Thus selecting important features is an important issue in intrusion detection. Another issue in intrusion detection is that most of the intrusion detection systems are performed by off-line and it is not a suitable method for a real-time intrusion detection system. In this paper, we develop the real-time intrusion detection system, which combines an on-line feature extraction method with the on-line Least Squares Support Vector Machine classifier. Applying the proposed system to KDD CUP 99 data, experimental results show that it has a remarkable feature feature extraction, classification performance and reducing detection time compared to existing off-line intrusion detection system.

The philosophy of the IoT world is becoming important for a projected, always-connected world. The 5G networks will significantly improve the value of 4G networks in the day-to-day world, making them fundamental to the next-generation IoT device networks. This article presents the current advances in the improvement of the standards, which simulate 5G networks. This article evaluates the experience that the authors gained when implementing Vodafone Romania 5G network services, illustrates the experience gained in context by analyzing relevant peer-to-peer work and used technologies, and outlines the relevant research areas and challenges that are likely to affect the design and implementation of large 5G data networks. This paper presents a machine learning-based real-time intrusion detection system with the corresponding intrusion prevention system. The convolutional neural network (CNN) is used to train the model. The system was evaluated in the context of the 5G data network. The smart intrusion detection system (IDS) takes the creation of software-defined networks into account. It uses models based on artificial intelligence. The system is capable to reveal not previously detected intrusions using software components based on machine learning, using the convolutional neural network. The intrusion prevention system (IPS) blocks the malicious traffic. This system was evaluated, and the results confirmed that it provides higher efficiencies compared to less overhead-like approaches, allowing for real-time deployment in 5G networks. The offered system can be used for symmetric and asymmetric communication scenarios.

The growing complexity of cyber threats necessitates creative solutions beyond conventional rule-based security systems. This study presents a new method for the incorporation of artificial intelligence (AI) into intrusion detection and prevention systems (IDPS) that facilitates real-time threat mitigation, adaptive learning, and autonomous response. Through the use of machine learning (ML), behavioural analytics, and generative AI, this solution overcomes the weaknesses of legacy systems while maximizing accuracy, scalability, and operational efficiency in cybersecurity. Key Words: Artificial Intelligence (AI); Cybersecurity; Intrusion Detection System (IDS); Intrusion Prevention System (IPS); Real-Time Threat Detection; Machine Learning (ML); Anomaly Detection; Behavioural Analytics; User and Entity Behaviour Analytics (UEBA); Automated Incident Response; Adaptive Learning; Generative Adversarial Networks (GANs); Adversarial AI; Zero-Day Attack Detection; Security Orchestration, Automation, and Response (SOAR); Autonomous Cybersecurity; Cyber Threat Mitigation; Network Security; Deep Learning; Explainable AI (XAI); Federated Learning; Threat Intelligence; Real-Time Analytics; Predictive Cybersecurity; AI-Driven Defence Systems; Proactive Defence Mechanisms; Self-Improving Systems; Quantum-Resistant AI; Zero Trust Architecture; Cyber-Physical Systems Security

In the ever-evolving landscape of network security, the sophistication of cyber-attacks, especially Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, poses a formidable challenge to intrusion detection systems. Recognizing the longstanding application of CatBoost in various domains, this study explores its novel optimization for network intrusion detection, a critical area in need of advanced solutions. Leveraging the strengths of CatBoost in handling categorical data and imbalanced datasets, we meticulously adapt the classifier to meet the complex demands of distinguishing between DoS, DDoS, and benign traffic within the comprehensive CICIDS2017 and CSE-CIC-IDS2018 datasets. This research is an attempt to refine the learning efficiency and detection capabilities of CatBoost through the implementation of advanced feature selection and data preparation, contributing to the field by improving detection accuracy within real-time intrusion detection systems. The results show a notable improvement in performance, underscoring the classifier's role in advancing cybersecurity measures. Furthermore, the study paves the way for future exploration into adversarial machine learning and automated feature engineering, fortifying the resilience and adaptability of intrusion detection systems against the backdrop of a rapidly changing cyber threat landscape. These efforts provide solid approaches to address the current challenges in network security, signaling a move towards more refined and dependable intrusion detection methods.

Chapter 5 - Intrusion Prevention and Detection Systems

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

In the context of a computer system, computer security is the prevention of an illicit action against the system. For this purpose, computer security must determine the difference between normal and harmful activities. These activities can come from outside or from inside the system to be protected. In a similar manner, the role of the Human Immune System (HIS) is to detect and defend against harm. This similarity has inspired approaches in the area of computer security, including the use of immune-based approaches to build Intrusion Detection and Response Systems (IDRSs). As a concrete example, this chapter introduces a new approach for Intrusion Detection (ID) and Intrusion Response (IR) to build a completely distributed and decentralised IDRS for use in computer networks. This approach is called Intrusion Detection and Response extended with Agent Mobility, or IDReAM for short. IDReAM combines Mobile Agents (MAs) with two self-organising paradigms inspired by natural life systems. The Intrusion Detection System (IDS) is inspired by the metaphor of the immune system that protects the human body from external threats. Specialised cells of the immune system, called the T cells, travel around the body to detect possible threats by eliminating the proteins that they do not recognise as safe proteins—referred to as non-self proteins. Intrusion Detection Agents (IDAs) roam the network to detect suspicious behaviours in a manner that mimics the behaviour of T cells. The Intrusion Response System (IRS) also borrows mechanisms from the stigmergic paradigm of a colony of ants. At the time of foraging, the ants use the environment to diffuse a chemical substance called the pheromone which traces the route for the other ants from the nest to the source of food. Intrusion Response Agents (IRAs) roam the network to respond to the IDAs’ alerts, mimicking the behaviour of the ants to trace the route to the alert and give the response. The two natural systems exhibit a social behaviour by the organisation of their entities, T cells and ants, which is not possible without the functionality of mobility.KeywordsIntrusion DetectionAgent MobilityIntrusion Detection SystemComputer SecurityHuman Immune SystemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Traditionally, network storage systems have mainly been dominated by two IP-based storage technologies, i.e., Network Attached Storage (NAS) and Storage Area Network (SAN). In recent years, cloud based storage (e.g., Amazon S3) has gained growing popularity for its high flexibility and cross-platform compatibility. Many enterprises are considering to replace traditional storage systems with cloud-based systems. Evaluating such a transition demands a systematic study on understanding the performance behaviours of the emerging cloud storage. To fill in this gap, in this paper, we conduct a comprehensive study on the three storage systems with realistic network conditions. Specifically, we select one representative from each category for comparison, i.e., Network File System (NFS) from NAS, Internet Small Computer System Interface (iSCSI) from SAN, and OpenStack Swift from cloud storage. We build a testbed and develop a suite of micro-benchmarks to study the impact of network complexities. Through a set of experiments and detailed analysis, we make several key observations: (1) iSCSI excels under good network conditions, e.g., in local area networks (LANs) where network delay and packet loss are trivial, (2) NFS and Swift are more suitable for complex networks such as wireless networks and Internet environment, (3) Swift is a viable replacement for NFS in all scenarios we investigate, and (4) system configuration on the client side impacts storage performance significantly and deserves adequate attention. We hope our findings can not only shed light on storage service design and optimizations, but also encourage more research on emerging storage technologies.

Intrusion and intrusive activities have become a bottleneck for both Internet and Intranet users. An intrusion detection system tries to take care of such activities by constantly monitoring the user systems. Although there are two basic approaches in intrusion detection, i.e., misuse detection system and anomaly detection system, respectively, however, recent research works emphasize on hybrid approach which tries to gather the advantage of both misuse and anomaly-based systems. The proposed research work is based on such a hybrid system which uses misuse detection system for known types of intrusions and anomaly detection system for novel attacks. Frequency episode extraction method is specifically used for misuse-based detection and chi-square test is used for anomaly-based detection. Experiments show that the hybrid intrusion detection system is able to consider the real-time traffic of a network as well as the standard available data set for detecting the efficiency of the system. The proposed system learns and trains itself by detecting known attacks from misuse detection system and novel attacks from anomaly detection system, thereby improving the true positive rates and diminishing false negative rates consequently.

SUMMARYThe proliferation of cloud services and other forms of service‐oriented computing continues to accelerate. Alongside this development is an ever‐increasing need for storage within the data centres that host these services. Management applications used by cloud providers to configure their infrastructure should ideally operate in terms of high‐level policy goals, and not burden administrators with the details presented by particular instances of storage systems. One common technology used by cloud providers is the Storage Area Network (SAN). Support for seamless scalability is engineered into SAN devices. However, SAN infrastructure has a very large parameter space: their optimal deployment is a difficult challenge, and subsequent management in cloud storage continues to be difficult.parindent = 10pt In this article, we discuss our work in SAN configuration middleware, which aims to provide users of large‐scale storage infrastructure such as cloud providers with tools to assist them in their management and evolution of heterogeneous SAN environments. We propose a middleware rather than a stand‐alone tool so that the middleware can be a proxy for interacting with, and informing, a central repository of SAN configurations. Storage system users can have their SAN configurations validated against a knowledge base of best practices that are contained within the central repository. Desensitized information is exported from local management applications to the repository, and the local middleware can subscribe to updates that proactively notify storage users should particular configurations be updated to be considered as sub‐optimal, or unsafe. Copyright © 2011 John Wiley & Sons, Ltd.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Objective: To improve IDS strategy with high detection accuracy and reduce the power consumption of the nodes in MANET. Methods: There are several intrusion detection systems are developed. In order to increase the performance of IDS, Bayesian Correlated Equilibrium based IDS which incorporates two main processes namely, Cluster Head selection and Hybrid IDS for MANET is proposed. The game theory is also used to increase the detection accuracy of IDS. Findings: Mobile Ad-hoc Network (MANET) is an autonomous system that consists of battery powered mobile nodes. MANETs are prone to several attacks as they are continuously self configuring and infrastructure less. As the nodes are mobile, they are susceptible to intrusions. The Intrusion Detection System has issues of heavy traffic related to IDS in the network, which causes congestion. It also leads to high energy consumption among the nodes. So designing an efficient MANET should have certain number of goals such as effective intrusion detection, light traffic and low energy consumption and power loss. Many Intrusion detection schemes were proposed that normally incurs power loss in the node as there is a need for continuous monitoring. Application/Improvements: To increase detection accuracy, decrease power consumption and the IDS traffic Bayesian Correlated Equilibrium based IDS for MANET is presented.

Due to the increasing amount of data handled by business applications and the need of an easy way to access data by multiple servers, storage area networks (SANs) have been proposed as a solution to be deployed in enterprises networks. Despite their advantages, a set of security issues are related to these next generation high speed network architectures and that may be a threat to the performance and the availability of such networks. In this paper, we propose an intrusion detection and tolerance system that ensures protection of the SANs against attacks. The proposed solution is based on: (a) the management of two areas (virtual area and protected area) at each storage node; (b) the cooperation of detection modules running on each SAN component; and (c) the use of distributed set of rules that are updated and managed in a secure manner. A case study is given to illustrate the proposed system capabilities in terms of intrusion detection and tolerance.

Given the exponential growth of Internet and increased availability of bandwidth, Intrusion Detection has become the critical component of Information Security and the importance of secure networks has tremendously increased. Though the concept of Intrusion Detection was introduced by James Anderson J. P. in the year 1980, it has gained lots of importance in the recent years because of the recent attacks on the IT infrastructure. The main objective of this study is to examine the existing literature on various approaches for Intrusion Detection in particular Anomaly Detection, to examine their conceptual foundations, to taxonomize the Intrusion Detection System (IDS) and to develop a morphological framework for IDS for easy understanding. In this study a detailed survey of IDS from the initial days, the development of IDS, architectures, components are presented.