Study on Network Intrusion Detection Method Using Discrete Pre-Processing Method and Convolution Neural Network

Enhancing CNN-based network intrusion detection through hyperparameter optimization

Network Intrusion Detection Systems (NIDS) are critical in ensuring the security of connected computer systems by actively detecting and preventing unauthorized activities and malicious attacks. Machine learning (ML) and deep learning (DL) based NIDS models leverage algorithms that learn from historical network traffic data to identify patterns and anomalies to capture complex relationships. The primary objective of this research is to generate tags and descriptions for the packets that are difficult to classify by the NIDS. Most NIDS datasets that are publicly available have focused on flow data, offering aggregated information about network connections, and have played a crucial role in enabling researchers and network security professionals to design and develop flow-based NIDS solutions. While flow records provide valuable information for detecting network-level anomalies and attacks, they do not consider packet-level information and payload contents. In this research, we propose a packet-level approach for NIDS that leverages the flow information with the packet header fields and payload. To facilitate this research, we have curated a comprehensive Packet-level dataset constructed by extracting the Packet Capture (PCAP) files from two widely used flow-level datasets, namely CIC-IDS2017 and UNSW-NB15. Recent advancements in Natural Language Processing (NLP) have demonstrated the effectiveness of Transformer-based models in handling sequence data with tasks such as token classification and text generation. We have adapted this technology to NIDS to extract key features and characteristics of the header and payload in the context of various attacks. Unlike traditional classification methods that assign predefined labels to network packets, this method focuses on generating tags based on the packet signature that explains the packet content and potential risks. The tags and descriptions offer network security professionals a tool to comprehend suspicious packets with an unfamiliar or potentially malicious signature, assess their nature, and help make informed decisions promptly.

This paper attempts to provide a demonstration the importance of the feature selection (FS) in the data mining filed for the optimization. The author’s aim to develop a Convolutional Neural Network (CNN) based Network Intrusion Detection System (NIDS). The CNN was trained using the NSL-KDD dataset. The approach is divided into two methodologies: the first one, is to apply the CNN to the NSL-KDD dataset without FS, in the second methodology: the Information Gain (IG), Grain Ratio (GR) and Correlation Attribute (CA) were applied as FS methods then the CNN is use to classify the intrusion. The performance is proven by comparing our results with other previous works. Our experimentation results show that CNN with FS has a good accuracy 99,72%, true positive rate: 99,29%, false positive rate: 0,18%. Thus, the CNN with FS has outperform the other methods. But the methods use in the FS phase don’t guarantee the use of the best subset or the optimal subset. As future orientation is to develop another method for FS which guarantee the selection of the best and the optimal relevant feature.

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

Network intrusion detection systems (NIDS) are essential security building-blocks for today's organizations to ensure safe and trusted communication of information. In this paper, we study the feasibility of off-line deep learning based NIDSes by constructing the detection engine with multiple advanced deep learning models and conducting a quantitative and comparative evaluation of those models. We first introduce the general deep learning methodology and its potential implication on the network intrusion detection problem. We then review multiple machine learning solutions to two network intrusion detection tasks (NSL-KDD and UNSW-NB15 datasets). We develop a TensorFlow-based deep learning library, called NetLearner, and implement a handful of cutting-edge deep learning models for NIDS. Finally, we conduct a quantitative and comparative performance evaluation of those models using NetLearner.

This paper describes the ESIDE-Depian intrusion detection and prevention system, which uses Bayesian structural and parametric learning and also evidence propagation and adaptation, in order to improve the accuracy and manageability of network intrusion detection systems (NIDS). Current NIDS do not consider the two main detection paradigms, i.e. misuse detection and anomaly detection, in an unified style, so the analysis is not inherently complete. Besides, historical data are not generally used, neither for analysis nor for sequential adaptation of the knowledge representation models used for detection; hence this wealthy information about the essence and the potential trends of the target system is not commonly considered. Thus, by the generalized use of Bayesian belief networks, ESIDE-Depian achieves the main goal of detecting and preventing both well-known and also zero-day attacks with excellent results, by means of unified real-time analysis of network traffic.

Network intrusion detection systems (NIDS) are essential for protecting computer networks against cyberattacks. The selection of a nominal set of essential features that may adequately discriminate malicious traffic from normal traffic is indispensable while developing a NIDS. As such, a more reliable and accurate detection result may be realized when intrusion detection is carried out on a dataset based on an inclusive feature representation. This work presents the pre-processing and feature selection workflow as well as its results in the case of the CIC-IDS-2017 dataset, with a focus on two cyber-attacks, namely Denial-of-Service (DoS) and PortScan. The study applied an ensemble feature selection method based on information gain and Random Forest to filter out important features. Recursive Feature Elimination method was then applied to the reduced features to optimize the selected feature subset. The selected feature subset was experimented with using two classification algorithms, namely support vector machine and multi-layer perceptron. In the evaluation process, four widely used performance metrics were considered. The study results demonstrated the efficacy of the proposed ensemble approach to optimize the selected feature subset for detecting PortScan and DoS attacks in network traffic. Experimental results revealed that the support vector machine had a slight advantage in accuracy and could train more quickly. According to the study's evaluation, the NIDS may be able to shorten processing times without sacrificing the ability to detect PortScan and DoS attacks accurately by choosing a narrow subset of informative features. This suggests the approach might be applicable to real-world NIDS scenarios involving these attacks. The study also provides encouraging perspectives on how ensemble feature selection utilizing MLP and SVM can enhance the effectiveness of NIDS. Building on these findings, more research can create NIDS solutions that are even more reliable and efficient for the dynamic field of cybersecurity.

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system

Network intrusion detection systems, or NIDS, are essential for defending computer networks from several types of security threats and assaults. There is a growing need within network attacks become more complicated and frequent, sophisticated analytics methods to improve NIDS's capacity for detection and reaction. The creation and application of analytics techniques for network intrusion detection systems is the main topic of this study. Utilizing these methods canhelp NIDS be more accurate, efficient, and effective at detecting and mitigating security breaches. The first part of the study looks at the foundational ideas of network intrusion detection, including the various kinds of attacks and the difficulties in detecting them. The advantages of several NIDS systems, such as signature-based and anomaly-based systems, are highlighted and restricted. The overall goal of this research is to enhance the field of network intrusion detection by using analytics approaches to increase NIDS's capabilities. The suggested techniques can decrease false positives, enhance automated incident response, process large amounts of data more effectively, and increase the accuracy of attack detection. In the face of constantly changing cyber threats, the research findings will aid in the creation of stronger and more efficient network security solutions. Keywords - Network intrusion detection systems, Analytics techniques, Security breaches, False positives, Cyber threats

Cyber-security experts often require the help of an automated process that filters and classifies network attacks. To apply specific preventive measures for securing networks, the classification of the attack type is the key. Many Machine Learning (ML) models have been proposed as a base for Network Intrusion Detection (NID) systems. However, their performance varies based on multiple factors. For instance, an ML model fitted on a highly imbalanced dataset can be biased toward over-represented attack types. On the other hand, paying attention only to the ML model’s performance in the minority classes can negatively affect its performance in the majority classes. This paper proposes an NID system that addresses the issue of imbalanced datasets and uses Convolutional Neural Networks (CNN) to classify the different attack types. We compare the performance of our proposed system to other systems that use: Random Over-Sampling (ROS), Synthetic Minority Oversampling TEchnique (SMOTE), Adaptive Synthetic Sampling (ADASYN), and Generative Adversarial Networks (GAN). Using the NSL-KDD and the BoT-IoT datasets for benchmarking, we show that our proposed system performs well in the minority classes: recall scores of 70.50% and 72.08% on the User to Root (U2R) and Remote to Local (R2L) attack classes of the NSL-KDD dataset, respectively, while maintaining an overall False Alarm Rate (FAR) of 6.50% and a recall of 90.46% on the binary classification task. Our proposed system scores a weighted average F1-Score of 99.45% on the multi-class classification task using the BoT-IoT dataset.

Weight embedding autoencoder as feature representation learning in an intrusion detection systems

The demand for safe internet access will increase in the future, as a variety of malicious attacks are targeting fragile devices in the network. For this reason, a network intrusion detection system (NIDS) is utilized to detect and notify attacks. Various algorithms employing pattern analysis techniques have been successfully implemented in NIDS, such as shallow machine learning and deep learning models. However, the problem of an imbalanced dataset is often negligible in intrusion detection. Often, the results achieved by machine learning tend to majority classes and ignore minority classes. Therefore, we propose the focal loss network intrusion detection system (FL-NIDS), an improved classification model, to address the issue of an imbalanced dataset. This paper focuses on finding the most appropriate hyperparameter values for focal loss in intrusion detection systems. To show the effectiveness of the proposed FL-NIDS, we utilize the UNSW-NB15 dataset, which suffers the imbalance classes. Our experiment shows that the FL-NIDS using the best combination parameters of focal loss obtain higher detection accuracy in the majority classes as well as in the minority classes, compared to the general model such as Deep Neural Network (DNN) and Convolutional Neural Network (CNN).

System administrators use a network intrusion detection system (NIDS) to identify network security breaches inside their own firm. Building a clever and robust NIDS for irregular and capricious attacks, however, raises various challenges. One of the key subjects in NIDS research in recent years has been the application of machine learning understanding of strategies. This approach provides a network intrusion detection tool that effectively identifies several kinds of network intrusions, including Dos, U2R, R2L, Probe, and Normal.It employs twin support vector machines and decision trees. The trees serve to construct the decision tree for network traffic data. Then, to maximize the separation of the top nodes of the decision tree, the bottom-up merging approach is applied, hence minimizing error buildup during generation. Embedding twin support vector machines inside the decision tree allows one to subsequently use the network intrusion detection model. This performance assessment is based on network intrusion detection analysis datasets—namely KDD-CUP99 and NSLKDD.

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …