Weight embedding autoencoder as feature representation learning in an intrusion detection systems

The demand for safe internet access will increase in the future, as a variety of malicious attacks are targeting fragile devices in the network. For this reason, a network intrusion detection system (NIDS) is utilized to detect and notify attacks. Various algorithms employing pattern analysis techniques have been successfully implemented in NIDS, such as shallow machine learning and deep learning models. However, the problem of an imbalanced dataset is often negligible in intrusion detection. Often, the results achieved by machine learning tend to majority classes and ignore minority classes. Therefore, we propose the focal loss network intrusion detection system (FL-NIDS), an improved classification model, to address the issue of an imbalanced dataset. This paper focuses on finding the most appropriate hyperparameter values for focal loss in intrusion detection systems. To show the effectiveness of the proposed FL-NIDS, we utilize the UNSW-NB15 dataset, which suffers the imbalance classes. Our experiment shows that the FL-NIDS using the best combination parameters of focal loss obtain higher detection accuracy in the majority classes as well as in the minority classes, compared to the general model such as Deep Neural Network (DNN) and Convolutional Neural Network (CNN).

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

The Internet continues to spread itself over the globe, providing a great opportunity for various threats which are growing on a daily basis. Current static detection techniques only detect known malicious attacks and they also require frequent updates to signature-based databases. To reduce this work, systems are proposed for network intrusion detection systems capable of analyzing contents of the network by means of machine learning techniques to analyze and classify the malicious contents. Various machine learning algorithms are used for developing a Network Intrusion Detection System. The review intends to provide an exhaustive survey of the currently proposed machine learning based intrusion detection systems in order to assist Network Intrusion Detection System developers to gain a better intuition.

Enhancing CNN-based network intrusion detection through hyperparameter optimization

Genetic convolutional neural network for intrusion detection systems

Network Intrusion Detection Systems (NIDS) are critical in ensuring the security of connected computer systems by actively detecting and preventing unauthorized activities and malicious attacks. Machine learning (ML) and deep learning (DL) based NIDS models leverage algorithms that learn from historical network traffic data to identify patterns and anomalies to capture complex relationships. The primary objective of this research is to generate tags and descriptions for the packets that are difficult to classify by the NIDS. Most NIDS datasets that are publicly available have focused on flow data, offering aggregated information about network connections, and have played a crucial role in enabling researchers and network security professionals to design and develop flow-based NIDS solutions. While flow records provide valuable information for detecting network-level anomalies and attacks, they do not consider packet-level information and payload contents. In this research, we propose a packet-level approach for NIDS that leverages the flow information with the packet header fields and payload. To facilitate this research, we have curated a comprehensive Packet-level dataset constructed by extracting the Packet Capture (PCAP) files from two widely used flow-level datasets, namely CIC-IDS2017 and UNSW-NB15. Recent advancements in Natural Language Processing (NLP) have demonstrated the effectiveness of Transformer-based models in handling sequence data with tasks such as token classification and text generation. We have adapted this technology to NIDS to extract key features and characteristics of the header and payload in the context of various attacks. Unlike traditional classification methods that assign predefined labels to network packets, this method focuses on generating tags based on the packet signature that explains the packet content and potential risks. The tags and descriptions offer network security professionals a tool to comprehend suspicious packets with an unfamiliar or potentially malicious signature, assess their nature, and help make informed decisions promptly.

This paper describes the ESIDE-Depian intrusion detection and prevention system, which uses Bayesian structural and parametric learning and also evidence propagation and adaptation, in order to improve the accuracy and manageability of network intrusion detection systems (NIDS). Current NIDS do not consider the two main detection paradigms, i.e. misuse detection and anomaly detection, in an unified style, so the analysis is not inherently complete. Besides, historical data are not generally used, neither for analysis nor for sequential adaptation of the knowledge representation models used for detection; hence this wealthy information about the essence and the potential trends of the target system is not commonly considered. Thus, by the generalized use of Bayesian belief networks, ESIDE-Depian achieves the main goal of detecting and preventing both well-known and also zero-day attacks with excellent results, by means of unified real-time analysis of network traffic.

An intrusion detection system (IDS) is an important protection instrument for detecting complex network attacks. Various machine learning (ML) or deep learning (DL) algorithms have been proposed for implementing anomaly-based IDS (AIDS). Our review of the AIDS literature identifies some issues in related work, including the randomness of the selected algorithms, parameters, and testing criteria, the application of old datasets, or shallow analyses and validation of the results. This paper comprehensively reviews previous studies on AIDS by using a set of criteria with different datasets and types of attacks to set benchmarking outcomes that can reveal the suitable AIDS algorithms, parameters, and testing criteria. Specifically, this paper applies 10 popular supervised and unsupervised ML algorithms for identifying effective and efficient ML-AIDS of networks and computers. These supervised ML algorithms include the artificial neural network (ANN), decision tree (DT), k-nearest neighbor (k-NN), naive Bayes (NB), random forest (RF), support vector machine (SVM), and convolutional neural network (CNN) algorithms, whereas the unsupervised ML algorithms include the expectation-maximization (EM), k-means, and self-organizing maps (SOM) algorithms. Several models of these algorithms are introduced, and the turning and training parameters of each algorithm are examined to achieve an optimal classifier evaluation. Unlike previous studies, this study evaluates the performance of AIDS by measuring the true positive and negative rates, accuracy, precision, recall, and F-Score of 31 ML-AIDS models. The training and testing time for ML-AIDS models are also considered in measuring their performance efficiency given that time complexity is an important factor in AIDSs. The ML-AIDS models are tested by using a recent and highly unbalanced multiclass CICIDS2017 dataset that involves real-world network attacks. In general, the k-NN-AIDS, DT-AIDS, and NB-AIDS models obtain the best results and show a greater capability in detecting web attacks compared with other models that demonstrate irregular and inferior results.

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

Internet has positively changed social, political and economic structures and in many ways obviating geographical boundaries. The enormous contributions of Internet to business transactions coupled with its ease of use has resulted in increased number of internet users and consequently, intruders. It is crucial to safeguard computer resources with the aid of Intrusion Detection Systems (IDS) in addition to Intrusion Prevention Systems. In recent times, enormous network traffic generated in terabytes within couples of seconds are difficult to analyze with the traditional rule-based approach; hence, researchers have to subject data mining techniques to intrusion detection with emphasis on intrusion detection accuracy; relevant feature selection leads to faster and enhanced accurate detection rate. Therefore, this paper presents a light weight IDS based on information gain and Multi-layer perceptron Neural Network. Gain ratio was used in selecting relevant features for attack and normal traffic prior classification using Neural Network. Empirical results from the UNSW-NB15 intrusion detection dataset on thirty selected attributes is a highly ranked decision, thus, the light weight IDS is suitable for real time intrusion detection.

Federated transfer learning-based intrusion detection system in 5G networks

Network Intrusion Detection Systems (NIDS) which should perform time-consuming evaluation of every packet received from network have faced throughput challenge as a result of the increase in the speed of network communications and the high volume of Internet threats. In an NIDS, the most important and time-consuming processes are pattern matching and deep inspection of the header and the body of packets. Several analyses show that this process can take up to 75% of the time of processing packets. In this paper, relying on the processing power of general purpose graphics cards - which seem to be a better option compared to other hardware technologies like FPGAs with regard to speed, scalability, flexibility, ease of programming and price - and with the idea of having the signature-based detection engine of NIDS systems run on GPU rather than CPU, it is tried to present an efficient method to increase the speed of intrusion detection systems such as Snort. The proposed method provides a means to perform payload matching and non-payload matching of packets in a parallel platform on GPU, which can speed up the signature-based detection engine of Snort 3.6.

The network intrusion detection system is a core technology of network security that detects packets for malicious activities occurring in the network and is an essential element for stable services in extended network environments such as big data and IoT. These network intrusion detection systems have been studied together with machine learning and deep learning, but performance is not guaranteed in the actual environment or the class balance problem has not been solved. Therefore, in this study, we investigate the performance of a discretization preprocessing method with a CNN-based classifier on the class imbalance problem of network traffic data. The preprocessing method adds a discretization algorithm for continuous variables in the commonly used conventional preprocessing method and converts 1D network packet vectors into 2D image vectors to improve relational analysis and generalization performance. Since the convolution neural network has immutability to the input data, it improves statistical efficiency in learning network packets converted into images. To evaluate the proposed model, we compared the computational complexity and generalization performance using NSL-KDD and CSE-CIC-IDS 2018, which is a representative network packet data. As a result of the experiment, it was confirmed that in the case of computational complexity, training time and parameters were reduced compared to the model designed similarly to the proposed model, and accuracy and F1 score improved in generalization performance.

Machine Learning-powered Network Intrusion Detection Systems (NIDS) have become essential for detecting complex cyber threats. However, they remain highly vulnerable to adversarial attacks, specially crafted inputs that appear benign while hiding malicious intent. In this study, we introduce a fully quantum Generative Adversarial Network (QGAN) designed to generate such deceptive network traffic. Our QGAN uses parameterized quantum circuits for both the generator and discriminator and is trained on selected features from the UNSWNB15 dataset using IBM Quantum hardware via the Qiskit Runtime Estimator. The quantum-generated samples closely mimic normal traffic and achieve a 95.3% evasion rate against a Random Forest-based NIDS—significantly outperforming classical methods such as SMOTE, classical GANs, and random sampling. We assess the quality and realism of the generated traffic using statistical distance metrics, including the Kolmogorov-Smirnov (KS) statistic, Wasserstein distance, and Jensen-Shannon Divergence (JSD), along with t-SNE visualizations. These evaluations confirm that the QGAN produces statistically realistic and stealthy adversarial samples that can bypass traditional detection mechanisms. Our results highlight the dual-use nature of quantum AI in cybersecurity—offering both a novel threat vector and a powerful tool to stresstest and improve future intrusion detection systems.

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system