A Survey on Hybrid Intrusion Detection Techniques

Security in IoT networks is currently mandatory, due to the high amount of data that has to be handled. These systems are vulnerable to several cybersecurity attacks, which are increasing in number and sophistication. Due to this reason, new intrusion detection techniques have to be developed, being as accurate as possible for these scenarios. Intrusion detection systems based on machine learning algorithms have already shown a high performance in terms of accuracy. This research proposes the study and evaluation of several preprocessing techniques based on traffic categorization for a machine learning neural network algorithm. This research uses for its evaluation two benchmark datasets, namely UGR16 and the UNSW-NB15, and one of the most used datasets, KDD99. The preprocessing techniques were evaluated in accordance with scalar and normalization functions. All of these preprocessing models were applied through different sets of characteristics based on a categorization composed by four groups of features: basic connection features, content characteristics, statistical characteristics and finally, a group which is composed by traffic-based features and connection direction-based traffic characteristics. The objective of this research is to evaluate this categorization by using various data preprocessing techniques to obtain the most accurate model. Our proposal shows that, by applying the categorization of network traffic and several preprocessing techniques, the accuracy can be enhanced by up to 45%. The preprocessing of a specific group of characteristics allows for greater accuracy, allowing the machine learning algorithm to correctly classify these parameters related to possible attacks.

Download Full-text

A Comparative Study of AI-Based Intrusion Detection Techniques in Critical Infrastructures

ACM Transactions on Internet Technology ◽

10.1145/3406093 ◽

2021 ◽

Vol 21 (4) ◽

pp. 1-22

Author(s):

Safa Otoum ◽

Burak Kantarci ◽

Hussein Mouftah

Keyword(s):

Reinforcement Learning ◽

Intrusion Detection ◽

Comparative Study ◽

Performance Metrics ◽

Action Learning ◽

Smart Devices ◽

Critical Infrastructures ◽

State Action ◽

Detection Techniques ◽

Depth Analysis

Volunteer computing uses Internet-connected devices (laptops, PCs, smart devices, etc.), in which their owners volunteer them as storage and computing power resources, has become an essential mechanism for resource management in numerous applications. The growth of the volume and variety of data traffic on the Internet leads to concerns on the robustness of cyberphysical systems especially for critical infrastructures. Therefore, the implementation of an efficient Intrusion Detection System for gathering such sensory data has gained vital importance. In this article, we present a comparative study of Artificial Intelligence (AI)-driven intrusion detection systems for wirelessly connected sensors that track crucial applications. Specifically, we present an in-depth analysis of the use of machine learning, deep learning and reinforcement learning solutions to recognise intrusive behavior in the collected traffic. We evaluate the proposed mechanisms by using KDD’99 as real attack dataset in our simulations. Results present the performance metrics for three different IDSs, namely the Adaptively Supervised and Clustered Hybrid IDS (ASCH-IDS), Restricted Boltzmann Machine-based Clustered IDS (RBC-IDS), and Q-learning based IDS (Q-IDS), to detect malicious behaviors. We also present the performance of different reinforcement learning techniques such as State-Action-Reward-State-Action Learning (SARSA) and the Temporal Difference learning (TD). Through simulations, we show that Q-IDS performs with detection rate while SARSA-IDS and TD-IDS perform at the order of .

Download Full-text

Intrusion detection techniques in network environment: a systematic review

Wireless Networks ◽

10.1007/s11276-020-02529-3 ◽

2021 ◽

Author(s):

Maruthi Rohit Ayyagari ◽

Nishtha Kesswani ◽

Munish Kumar ◽

Krishan Kumar

Keyword(s):

Systematic Review ◽

Intrusion Detection ◽

Network Environment ◽

Detection Techniques

Download Full-text

Analysis of Classification-Based Intrusion-Detection Techniques

Information Security and Optimization ◽

10.1201/9781003045854-9 ◽

2020 ◽

pp. 121-142

Author(s):

S. Sridevi ◽

R. Anandan

Keyword(s):

Intrusion Detection ◽

Detection Techniques

Download Full-text

A Review of Intrusion Detection Systems in Cloud Computing

Cloud Security ◽

10.4018/978-1-5225-8176-5.ch003 ◽

2019 ◽

pp. 54-83

Author(s):

Chiba Zouhair ◽

Noreddine Abghour ◽

Khalid Moussaid ◽

Amina El Omri ◽

Mohamed Rida

Keyword(s):

Cloud Computing ◽

Intrusion Detection ◽

Detection System ◽

Security Requirements ◽

Intrusion Detection Systems ◽

Cloud Environment ◽

Detection Techniques ◽

Detection Systems ◽

Cloud Architecture ◽

Data Source

Security is a major challenge faced by cloud computing (CC) due to its open and distributed architecture. Hence, it is vulnerable and prone to intrusions that affect confidentiality, availability, and integrity of cloud resources and offered services. Intrusion detection system (IDS) has become the most commonly used component of computer system security and compliance practices that defends cloud environment from various kinds of threats and attacks. This chapter presents the cloud architecture, an overview of different intrusions in the cloud, the challenges and essential characteristics of cloud-based IDS (CIDS), and detection techniques used by CIDS and their types. Then, the authors analyze 24 pertinent CIDS with respect to their various types, positioning, detection time, and data source. The analysis also gives the strength of each system and limitations in order to evaluate whether they carry out the security requirements of CC environment or not.

Download Full-text

Intrusion Detection Techniques in Cloud

10.1201/9781003004486-8 ◽

2021 ◽

pp. 109-130

Author(s):

Preeti Mishra ◽

Emmanuel S Pilli ◽

R C Joshi

Keyword(s):

Intrusion Detection ◽

Detection Techniques

Download Full-text

Hybrid Intrusion Detection Framework for Ad hoc networks

International Journal of Information Security and Privacy ◽

10.4018/ijisp.2016100101 ◽

2016 ◽

Vol 10 (4) ◽

pp. 1-32 ◽

Cited By ~ 5

Author(s):

Abdelaziz Amara Korba ◽

Mehdi Nafaa ◽

Salim Ghanemi

Keyword(s):

Intrusion Detection ◽

Anomaly Detection ◽

Ad Hoc Networks ◽

Intrusion Detection System ◽

Ad Hoc ◽

Detection System ◽

Security Framework ◽

Detection Techniques ◽

Wide Range ◽

Hoc Networks

In this paper, a cluster-based hybrid security framework called HSFA for ad hoc networks is proposed and evaluated. The proposed security framework combines both specification and anomaly detection techniques to efficiently detect and prevent wide range of routing attacks. In the proposed hierarchical architecture, cluster nodes run a host specification-based intrusion detection system to detect specification violations attacks such as fabrication, replay, etc. While the cluster heads run an anomaly-based intrusion detection system to detect wormhole and rushing attacks. The proposed specification-based detection approach relies on a set of specifications automatically generated, while anomaly-detection uses statistical techniques. The proposed security framework provides an adaptive response against attacks to prevent damage to the network. The security framework is evaluated by simulation in presence of malicious nodes that can launch different attacks. Simulation results show that the proposed hybrid security framework performs significantly better than other existing mechanisms.

Download Full-text