Expert Knowledge Correlated Evaluation of Intrusion Detection System in Heterogeneous IoT

Expert Knowledge ◽

Detection System ◽

Evaluation Framework ◽

Intrusion Detection And Prevention

Root Cause ◽

Network Intrusion ◽

Misclassification Rates ◽

<div>The dynamic heterogeneous IoT contexts adversely affect the performance of learning-based network intrusion detection and prevention systems resulting in increased misclassification rates—necessitating an expert knowledge correlated evaluation framework. The proposed framework includes intrusion root cause analysis and a correlation model that can be generalized over any network intrusion dataset, corresponding expert knowledge, detection technique, and learning-based algorithm. The experimentations prove the robustness of the propounded</div><div>framework on imbalanced datasets.</div>

Expert Knowledge Correlated Intrusion Detection System Evaluation Framework for Heterogeneous IoT

10.36227/techrxiv.16722784.v2 ◽

2021 ◽

Author(s):

Nitish A ◽

J. Hanumanthappa ◽

Shiva Prakash S.P ◽

Kirill Krinkin

Keyword(s):

Intrusion Detection ◽

Expert Knowledge ◽

Detection System ◽

Evaluation Framework ◽

Support Vector ◽

Minimal Processing ◽

Network Intrusion ◽

Misclassification Rates ◽

Improved Performance ◽

Neural Network Classifiers

The dynamic contexts of heterogeneous Internet of Things (HetIoT) adversely affect the performance of learning-based network intrusion detection systems (NIDS) resulting in increased misclassification rates---necessitating an expert knowledge correlated evaluation framework. The proposed generalizable framework includes intrusion root cause analysis, correlation model, and correlated classification metrics that can be generalized over any NID dataset, corresponding expert knowledge, detection technique, and learning-based algorithm to facilitate context-awareness in reducing false alerts. To achieve this, we perform experimentations on the Bot-IoT dataset---with generalized traffic behaviors from multiple existing NID datasets---employing the Support Vector Machine (SVM) machine learning and Multilayer Perceptron (MLP) shallow neural network classifiers, demonstrating the generalizability, robustness, and improved performance of the propounded framework compared to the existing literature. Furthermore, the proposed framework offers minimal processing overhead on the classifier algorithms.<br>

NETWORK INTRUSION DETECTION AND PREVENTION ATTACKS

INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY ◽

10.24297/ijct.v2i3a.2669 ◽

2012 ◽

Vol 2 (3) ◽

pp. 21-23

Author(s):

Harpreet Kaur

Keyword(s):

Intrusion Detection ◽

Distributed System ◽

Detection System ◽

Intrusion Detection And Prevention

Business Sector ◽

Network Systems ◽

Network Intrusion ◽

Entire Network ◽

Intrusion detection is an important technology in business sector as well as an active area of research. It is an important tool for information security. A Network Intrusion Detection System is used to monitor networks for attacks or intrusions and report these intrusions to the administrator in order to take evasive action. Today computers are part of networked; distributed systems that may span multiple buildings sometimes located thousands of miles apart. The network of such a system is a pathway for communication between the computers in the distributed system. The network is also a pathway for intrusion. This system is designed to detect and combat some common attacks on network systems. It follows the signature based IDs methodology for ascertaining attacks. A signature based IDS will monitor packets on the network and compare them against a database of signatures or attributes from known malicious threats. In this system the attack log displays the list of attacks to the administrator for evasive action. This system works as an alert device in the event of attacks directed towards an entire network.

Proposal to WNIDS Wireless Network Intrusion Detection System

International Journal of Scientific Research ◽

10.15373/22778179/oct2013/29 ◽

2012 ◽

Vol 2 (10) ◽

pp. 4-8

Author(s):

Dr. Saad K Majeed ◽

◽

Dr. Soukaena H Hashem ◽

Ikhlas K Gbashi

Keyword(s):

Intrusion Detection ◽

Wireless Network ◽

Detection System ◽

Network Intrusion Detection System

Network Intrusion ◽

Genetic Algorithm's Fitness Value and False Positive in Network Intrusion Detection System

i-manager’s Journal on Software Engineering ◽

10.26634/jse.3.2.244 ◽

2008 ◽

Vol 3 (2) ◽

pp. 14-19

Author(s):

Jeya S

Keyword(s):

Intrusion Detection ◽

False Positive ◽

Detection System ◽

Network Intrusion ◽

Network Intrusion Detection System ◽

Fitness Value

Proposed Hybrid Classifier to Improve Network Intrusion Detection System using Data Mining Techniques

Engineering and Technology Journal ◽

10.30684/etj.v38i1b.149 ◽

2020 ◽

Vol 38 (1B) ◽

pp. 6-14

Author(s):

ٍٍSarah M. Shareef ◽

Soukaena H. Hashim

Keyword(s):

Intrusion Detection ◽

False Alarm ◽

Detection System ◽

Multinomial Logistic Regression ◽

Limiting Factor ◽

Network Intrusion ◽

Network Intrusion Detection System ◽

Normal Behavior

Network intrusion detection system (NIDS) is a software system which plays an important role to protect network system and can be used to monitor network activities to detect different kinds of attacks from normal behavior in network traffics. A false alarm is one of the most identified problems in relation to the intrusion detection system which can be a limiting factor for the performance and accuracy of the intrusion detection system. The proposed system involves mining techniques at two sequential levels, which are: at the first level Naïve Bayes algorithm is used to detect abnormal activity from normal behavior. The second level is the multinomial logistic regression algorithm of which is used to classify abnormal activity into main four attack types in addition to a normal class. To evaluate the proposed system, the KDDCUP99 dataset of the intrusion detection system was used and K-fold cross-validation was performed. The experimental results show that the performance of the proposed system is improved with less false alarm rate.