Search

An incursion into the computer network or system in issue occurs whenever there is an attempt made to circumvent the defences that are in place. Training and examination are the two basic components that make up the intrusion detection system (IDS) and each one may be analysed separately. During training, a number of distinct models are built, each of which is able to distinguish between normal and abnormal behaviours that are included within the dataset. This article proposes a combination of ant colony optimization (ACO) and the firefly approach for feature selection. The final outcome of giving careful thought to the selection of features will eventually result in greater accuracy of categorisation. When classifying various sorts of features, we make use of a wide variety of machine learning (ML) algorithms, including AdaBoost, gradient boost, and Bayesian network (BN), amongst others. The tests and assessments made use of data obtained from three distinct datasets, namely NSL-KDD, UNSW-NB15, and CICIDS 2017. The degree of performance of an individual may be broken down into its component parts, which include the F1 score, accuracy, precision, and recall. Gradient boost performs far better when it comes to recognising and classifying incursions.

The Internet of Things (IoT) is a network of electrical devices that are connected to the Internet wirelessly. This group of devices generates a large amount of data with information about users, which makes the whole system sensitive and prone to malicious attacks eventually. The rapidly growing IoT-connected devices under a centralized ML system could threaten data privacy. The popular centralized machine learning (ML)-assisted approaches are difficult to apply due to their requirement of enormous amounts of data in a central entity. Owing to the growing distribution of data over numerous networks of connected devices, decentralized ML solutions are needed. In this paper, we propose a Federated Learning (FL) method for detecting unwanted intrusions to guarantee the protection of IoT networks. This method ensures privacy and security by federated training of local IoT device data. Local IoT clients share only parameter updates with a central global server, which aggregates them and distributes an improved detection algorithm. After each round of FL training, each of the IoT clients receives an updated model from the global server and trains their local dataset, where IoT devices can keep their own privacy intact while optimizing the overall model. To evaluate the efficiency of the proposed method, we conducted exhaustive experiments on a new dataset named Edge-IIoTset. The performance evaluation demonstrates the reliability and effectiveness of the proposed intrusion detection model by achieving an accuracy (92.49%) close to that offered by the conventional centralized ML models’ accuracy (93.92%) using the FL method.

With the development of intelligent technologies, Internet of Things (IoT) opens up a new era in the field of automotive networks, namely Internet of Vehicles (IoV). The main goal of IoV is to provide a secure and reliable network to vehicles so that users can enjoy various services. However, vulnerabilities and incomplete protection mechanisms have led to a proliferation of security threats against IoV networks. Intrusion detection technology is an effective protection solution for IoV security, especially when Artificial Intelligence (AI) technology has been introduced into intrusion detection study. This paper first briefly introduces the concept and features of IoV, and then reviews the related research on AI-based IoV intrusion detection systems (IDSs). Finally, we discuss the open challenges and future research directions.

Cyber-physical system security for electric distribution systems is critical. In direct switching attacks, often coordinated, attackers seek to toggle remote-controlled switches in the distribution network. Due to the typically radial operation, certain configurations may lead to outages and/or voltage violations. Existing optimization methods that model the interactions between the attacker and the power system operator (defender) assume knowledge of the attacker's parameters. This reduces their usability. Furthermore, the trend with coordinated cyberattack detection has been the use of centralized mechanisms, correlating data from dispersed security systems. This can be prone to single point failures. In this paper, novel mathematical models are presented for the attacker and the defender. The models do not assume any knowledge of the attacker's parameters by the defender. Instead, a machine learning (ML) technique implemented by a multi-agent system correlates detected attacks in a decentralized manner, predicting the targets of the attacker. Furthermore, agents learn optimal mitigation of the communication level through Q-learning. The learned attacker motive is also used by the defender to determine a new configuration of the distribution network. Simulations of the technique have been performed using the IEEE 123-Node Test Feeder. The simulation results validate the capability and performance of the algorithm. U.S. National Science Foundation [1837359]; Commonwealth Cyber Initiative (CCI), State of Virginia [PR6ZBSTA, 5GPG] Published version This work was supported in part by the U.S. National Science Foundation under Grant 1837359; and in part by the projects under Grant PR6ZBSTA and Grant 5GPG sponsored by Commonwealth Cyber Initiative (CCI), State of Virginia.

A large volume of security events, generally collected by distributed monitoring sensors, overwhelms human analysts at security operations centers and raises an alert fatigue problem. Machine learning is expected to mitigate this problem by automatically distinguishing between true alerts, or attacks, and falsely reported ones. Machine learning models should first be trained on datasets having correct labels, but the labeling process itself requires considerable human resources. In this paper, we present a new selective sampling scheme for efficient data labeling via unsupervised clustering. The new scheme transforms the byte sequence of an event into a fixed-size vector through content-defined chunking and feature hashing. Then, a clustering algorithm is applied to the vectors, and only a few samples from each cluster are selected for manual labeling. The experimental results demonstrate that the new scheme can select only 2% of the data for labeling without degrading the F1-score of the machine learning model. Two datasets, a private dataset from a real security operations center and a public dataset from the Internet for experimental reproducibility, are used.

Wireshark is easy for using as a packet inspection tool, in additional the feature of packets colorizing is easy for a various type of traffic. This paper exemplifies how Wireshark is used in networks as a tool. To clarify the effectiveness of malicious packet identification in any network, an experiment was conducted. Using the Wireshark program, testing was carried out in real time through experimentation and analysis. Inferences were drawn that clearly show Wireshark's capabilities as a tool in a powerful system for discovering the breach. The functionality of Wireshark is to analyze the network protocol and its open-source features for enabling the addition of likely tasks in the detecting devices were emphasized. Wireshark's skills for handling and interpreting packet data have been highlighted and the access control list (ACL) filtering has been the main application of Wireshark.

The number of users of the Internet has been continuously rising, with an estimated 5.1 billion users in 2023, which comprises around 64.7% of the total world population. This indicates the rise of more connected devices to the network. On average, 30,000 websites are hacked daily, and nearly 64% of companies worldwide experience at least one type of cyberattack. As per IDC’s 2022 Ransomware study, two-thirds of global organizations were hit by a ransomware attack that year. This creates the desire for a more robust and evolutionary attack detection and recovery model. One aspect of the study is the bio-inspiration models. This is because of the natural ability of living organisms to withstand various odd circumstances and overcome them with an optimization strategy. In contrast to the limitations of machine learning models with the need for quality datasets and computational availability, bio-inspired models can perform in low computational environments, and their performances are designed to evolve naturally with time. This study concentrates on exploring the evolutionary defence mechanism in plants and understanding how plants react to any known external attacks and how the response mechanism changes to unknown attacks. This study also explores how regenerative models, such as salamander limb regeneration, could build a network recovery system where services could be automatically activated after a network attack, and data could be recovered automatically by the network after a ransomware-like attack. The performance of the proposed model is compared to open-source IDS Snort and data recovery systems such as Burp and Casandra.

Internet of Things (IoT) technology has been incorporated into the majority of people’s everyday lives and places of employment due to the quick development in information technology. Modern agricultural techniques increasingly use the well-known and superior approach of managing a farm known as “smart farming”. Utilizing a variety of information and agricultural technologies, crops are observed for their general health and productivity. This requires monitoring the condition of field crops and looking at many other indicators. The goal of smart agriculture is to reduce the amount of money spent on agricultural inputs while keeping the quality of the final product constant. The Internet of Things (IoT) has made smart agriculture possible through data collection and storage techniques. For example, modern irrigation systems use effective sensor networks to collect field data for the best plant irrigation. Smart agriculture will become more susceptible to cyber-attacks as its reliance on the IoT ecosystem grows, because IoT networks have a large number of nodes but limited resources, which makes security a difficult issue. Hence, it is crucial to have an intrusion detection system (IDS) that can address such challenges. In this manuscript, an IoT-based privacy-preserving anomaly detection model for smart agriculture has been proposed. The motivation behind this work is twofold. Firstly, ensuring data privacy in IoT-based agriculture is of the utmost importance due to the large volumes of sensitive information collected by IoT devices, including on environmental conditions, crop health, and resource utilization data. Secondly, the timely detection of anomalies in smart agriculture systems is critical to enable proactive interventions, such as preventing crop damage, optimizing resource allocation, and ensuring sustainable farming practices. In this paper, we propose a privacy-encoding-based enhanced deep learning framework for the difficulty of data encryption and intrusion detection. In terms of data encoding, a novel method of a sparse capsule-auto encoder (SCAE) is proposed along with feature selection, feature mapping, and feature normalization. An SCAE is used to convert information into a new encrypted format in order to prevent deduction attacks. An attention-based gated recurrent unit neural network model is proposed to detect the intrusion. An AGRU is an advanced version of a GRU which is enhanced by an attention mechanism. In the results section, the proposed model is compared with existing deep learning models using two public datasets. Parameters such as recall, precision, accuracy, and F1-score are considered. The proposed model has accuracy, recall, precision, and F1-score of 99.9%, 99.7%, 99.9%, and 99.8%, respectively. The proposed method is compared using a variety of machine learning techniques such as the deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), and long short-term memory (LSTM).

Cybersecurity has become one of the focuses of organisations. The number of cyberattacks keeps increasing as Internet usage continues to grow. As new types of cyberattacks continue to emerge, researchers focus on developing machine learning (ML)-based intrusion detection systems (IDS) to detect zero-day attacks. They usually remove some or all attack samples from the training dataset and only include them in the testing dataset when evaluating the performance. This method may detect unknown attacks; however, it does not reflect the long-term performance of the IDS as it only shows the changes in the type of attacks. In this work, we focused on evaluating the long-term performance of ML-based IDS. To achieve this goal, we proposed evaluating the ML-based IDS using a dataset created later than the training dataset. The proposed method can better assess the long-term performance as the testing dataset reflects the changes in the attack type and network infrastructure changes over time. We have implemented six of the most popular ML models, including decision tree (DT), random forest (RF), support vector machine (SVM), naïve Bayes (NB), artificial neural network (ANN), and deep neural network (DNN). These models are trained and tested with a pair of datasets with symmetrical classes. Our experiments using the CIC-IDS2017 and the CSE-CIC-IDS2018 datasets show that SVM and ANN are most resistant to overfitting. Our experiments also indicate that DT and RF suffer the most from overfitting, although they perform well on the training dataset. On the other hand, our experiments using the LUFlow dataset have shown that all models can perform well when the difference between the training and testing datasets is small.

In traditional network management, the configuration of routing policies and associated settings on individual routers and switches was performed manually, incurring a considerable cost. By centralizing network management, software-defined networking (SDN) technology has reduced hardware construction costs and increased flexibility. However, this centralized architecture renders information security vulnerable to network attacks, making intrusion detection in the SDN environment crucial. Machine-learning approaches have been widely used for intrusion detection recently. However, critical issues such as unknown attacks, insufficient data, and class imbalance may significantly affect the performance of typical machine learning. We addressed these problems and proposed a transfer-learning method based on the SDN environment. The following experimental results showed that our method outperforms typical machine learning methods. (1) our model achieved a F1-score of 0.71 for anomaly detection for unknown attacks; (2) for small samples, our model achieved a F1-score of 0.98 for anomaly detection and a F1-score of 0.51 for attack types identification; (3) for class imbalance, our model achieved an F1-score of 1.00 for anomaly detection and 0.91 for attack type identification. In addition, our model required 15,230 seconds (4 h 13 m 50 s) for training, ranking second among the six models when considering both performance and efficiency. In future studies, we plan to combine sampling techniques with few-shot learning to improve the performance of minority classes in class imbalance scenarios.

Aiming at the problems of low accuracy of network attack prediction and long response time of attack detection, bidirectional long short-term memory (BiLSTM) was used to predict network attacks. However, BiLSTM has the problems of difficulty in parameter setting and low accuracy of the prediction model. This paper first proposes the Improved Grey Wolf algorithm (IGWO) to optimize the BiLSTM (IGWO-BiLSTM). First, IGWO uses Dimension Learning Hunting (DLH) strategy to construct the wolf neighborhood. In the established wolf neighborhood, the BiLSTM parameters are iteratively optimized to obtain a prediction model with fast convergence speed and small reconstruction error. Secondly, the dataset is preprocessed, and the IP packet statistical signature (IPDCF) is defined according to the characteristics of denial of service (DOS) and distributed denial of service (DDOS) attacks. IPDCF was used to establish the time series model and network traffic time series data were input into IGWO-BiLSTM to get the prediction results. Finally, the DOS and DDOS network packets were input into the trained prediction model to obtain the prediction results of attack data. By comparing the predicted values of IGWO-BiLSTM normal network packets and attack packets, a reasonable threshold is set to provide the basis for the subsequent attack prediction. Experiments show that the IGWO-BiLSTM can reach 99.05% of the fitting degree and accurately distinguish network attacks from normal network demand increases.

Modern smart grids are built based on top of advanced computing and networking technologies, where condition monitoring relies on secure cyberphysical connectivity. Over the network infrastructure, transported data containing confidential information, must be protected as smart grids are vulnerable and subject to various cyberattacks. Various machine learning based classifiers were proposed for intrusion detection in smart grids. However, each of them has respective advantage and disadvantages. Aiming to improve the performance of existing machine learning based classifiers, this paper proposes an adaptive deep learning algorithm with a data pre-processing module, a neural network pre-training module and a classifier module, which work together classify intrusion data types using their high-dimensional data features. The proposed Adaptive Deep Learning (ADL) algorithm obtains the number of layers and the number of neurons per layer by determining the characteristic dimension of the network traffic. With transfer learning, the proposed ADL algorithm can extract the original data dimensions and obtain new abstract features. By combining deep learning models with traditional machine learning-based classification models, the performance of classification of network traffic data is significantly improved. By using the Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) dataset, experimental results show that the proposed ADL algorithm improves the effectiveness of existing intrusion detection methods and reduces the training time, indicating a promising candidate to enhance network security in smart grids.

The Industrial Internet of Things (IIoT) refers to the employment of the Internet of Things in industrial management, where a substantial number of machines and devices are linked and synchronized with the help of software programs and third platforms to improve the overall productivity. The acquisition of the industrial IoT provides benefits that range from automation and optimization to eliminating manual processes and improving overall efficiencies, but security remains to be forethought. The absence of reliable security mechanisms and the magnitude of security features are significant obstacles to enhancing IIoT security. Over the last few years, alarming attacks have been witnessed utilizing the vulnerabilities of the IIoT network devices. Moreover, the attackers can also sink deep into the network by using the relationships amidst the vulnerabilities. Such network security threats cause industries and businesses to suffer financial losses, reputational damage, and theft of important information. This paper proposes an SDN-based framework using machine learning techniques for intrusion detection in an industrial IoT environment. SDN is an approach that enables the network to be centrally and intelligently controlled through software applications. In our framework, the SDN controller employs a machine-learning algorithm to monitor the behavior of industrial IoT devices and networks by analyzing traffic flow data and ultimately determining the flow rules for SDN switches. We use SVM and Decision Tree classification models to analyze our framework’s network intrusion and attack detection performance. The results indicate that the proposed framework can detect attacks in industrial IoT networks and devices with an accuracy of 99.7%.

Contemporary security information and event management (SIEM) solutions struggle to identify critical security incidents effectively due to the overwhelming number of false alerts generated by disparate security products, which results in significant alert fatigue and hinders effective incident response. To overcome this challenge, we propose a next-generation SIEM framework that integrates security orchestration automation and response capabilities and utilizes a divide-and-conquer strategy to mitigate the impact of low-quality IDS alerts. The proposed framework leverages advanced machine learning and data visualization tools—including a cost-sensitive learning method and an event segmenting algorithm—to filter and correlate alerts plus an augmented visualization tool to expedite the triage process. The proposed framework was evaluated experimentally on a dataset collected from a real-world enterprise network, and we report highly convincing results. The alert screening scheme demonstrates significant potential for real-world security operations. We believe that our findings will contributing to the development of a next-generation SIEM system that effectively addresses alert fatigue and lays the foundation for future research in this field.

This paper proposes an enhanced Transformer-based intrusion detection model to tackle the challenges of lengthy training time, inaccurate detection of overlapping classes, and poor performance in multi-class classification of current intrusion detection models. Specifically, the proposed model includes the following: (i) A data processing strategy that initially reduces the data dimension using a stacked auto-encoder to speed up training. In addition, a novel under-sampling method based on the KNN principle is introduced, along with the Borderline-SMOTE over-sampling method, for hybrid data sampling that balances the dataset while addressing the issue of low detection accuracy in overlapping data classes. (ii) An improved position encoding method for the Transformer model that effectively learns the dependencies between features by embedding the position information of features, resulting in better classification accuracy. (iii) A two-stage learning strategy in which the model first performs rough binary prediction (determining whether it is an illegal intrusion) and then inputs the prediction value and original features together for further multi-class prediction (predicting the intrusion category), addressing the issue of low accuracy in multi-class classification. Experimental results on the official NSL-KDD test set demonstrate that the proposed model achieves an accuracy of 88.7% and an F1-score of 88.2% in binary classification and an accuracy of 84.1% and an F1-score of 83.8% in multi-class classification. Compared to existing intrusion detection models, our model exhibits higher accuracy and F1-score and trains faster than other models.

The Internet of Vehicles (IoV) is a network system that enables wireless communication and information exchange between vehicles and other traffic participants. Intrusion detection plays a very important role in the IoV. However, with the development of the IoV, unknown attack behaviors may appear. The lack of analysis and collection of these attack behavior has led to an imbalance in the sample data categories of the IoV intrusion detection, which causes the problem of low detection accuracy. At the same time, the intrusion detection model usually needs to upload data to the cloud for training, which will introduce the privacy risk due to of the leakage of vehicle users’ information. In this paper, we propose an intrusion detection method for the IoV based on federated learning and memory-augmented autoencoder (FL-MAAE). We add a memory module to the autoencoder model to enhance its ability to store the behavior feature patterns of the IoV, make it robust to imbalanced samples, and use the reconstruction error as the evaluation index, so as to detect unknown attacks in the IoV. We propose a federated learning based training method for the IoV intrusion detection model. Local training of intrusion detection models in roadside units can effectively protect the privacy of data resources. We also designed an aggregation method based on the performance contribution of participants to improve the reliability of model aggregation. We conducted experiments on the NSL-KDD intrusion detection dataset to evaluate the performance of the proposed method. Experimental results show that our method has the best intrusion detection performance. In the case of contaminated samples, the accuracy and F1 score of the proposed method are 9.6% and 7.39% higher than those of the comparison methods on average.

The increasing attacks on traffic signals worldwide indicate the importance of intrusion detection. The existing traffic signal Intrusion Detection Systems (IDSs) that rely on inputs from connected vehicles and image analysis techniques can only detect intrusions created by spoofed vehicles. However, these approaches fail to detect intrusion from attacks on in-road sensors, traffic controllers, and signals. In this paper, we proposed an IDS based on detecting anomalies associated with flow rate, phase time, and vehicle speed, which is a significant extension of our previous work using additional traffic parameters and statistical tools. We theoretically modelled our system using the Dempster–Shafer decision theory, considering the instantaneous observations of traffic parameters and their relevant historical normal traffic data. We also used Shannon’s entropy to determine the uncertainty associated with the observations. To validate our work, we developed a simulation model based on the traffic simulator called SUMO using many real scenarios and the data recorded by the Victorian Transportation Authority, Australia. The scenarios for abnormal traffic conditions were generated considering attacks such as jamming, Sybil, and false data injection attacks. The results show that the overall detection accuracy of our proposed system is 79.3% with fewer false alarms.

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

Electronic Control Units (ECUs) have been increasingly used in modern vehicles to control the operations of the vehicle, improve driving comfort, and safety. For the operation of the vehicle, these ECUs communicate using a Controller Area Network (CAN) protocol that has many security vulnerabilities. According to the report of Upstream 2022, more than 900 automotive cybersecurity incidents were reported in 2021 only. In addition to developing a more secure CAN protocol, intrusion detection can provide a path to mitigate cyberattacks on the vehicle. This paper proposes a machine learning-based intrusion detection system (IDS) using a Support Vector Machine (SVM), Decision Tree (DT), and K-Nearest Neighbor (KNN) and investigates the effectiveness of the IDS using multiple real-world datasets. The novelty of our developed IDS is that it has been trained and tested on multiple vehicular datasets (Kia Soul and a Chevrolet Spark) to detect and classify intrusion. Our IDS has achieved accuracy up to 99.9% with a high true positive and a low false negative rate. Finally, the comparison of our performance evaluation outcomes demonstrates that the proposed IDS outperforms the existing works in terms of its liability and efficiency to detect cyber-attacks with a minimal error rate.

For in-vehicle network communication, the controller area network (CAN) broadcasts to all connected nodes without address validation. Therefore, it is highly vulnerable to all sorts of attack scenarios. This research proposes a novel intrusion detection system (IDS) for CAN to identify in-vehicle network anomalies. The statistical characteristics of attacks provide valuable information about the inherent intrusion patterns and behaviors. We employed two real-world attack scenarios from publicly available datasets to record a real-time response against intrusions with increased precision for in-vehicle network environments. Our proposed IDS can exploit malicious patterns by calculating thresholds and using the statistical properties of attacks, making attack detection more efficient. The optimized threshold value is calculated using brute-force optimization for various window sizes to minimize the total error. The reference values of normality require a few legitimate data frames for effective intrusion detection. The experimental findings validate that our suggested method can efficiently detect fuzzy, merge, and denial-of-service (DoS) attacks with low false-positive rates. It is also demonstrated that the total error decreases with an increasing attack rate for varying window sizes. The results indicate that our proposed IDS minimizes the misclassification rate and is hence better suited for in-vehicle networks.

Precision agriculture and smart farming have received significant attention due to the advancements made in remote sensing technology to support agricultural efficiency. In large-scale agriculture, the role of unmanned aerial vehicles (UAVs) has increased in remote monitoring and collecting farm data at regular intervals. However, due to an open environment, UAVs can be hacked to malfunction and report false data. Due to limited battery life and flight times requiring frequent recharging, a compromised UAV wastes precious energy when performing unnecessary functions. Furthermore, it impacts other UAVs competing for charging times at the station, thus disrupting the entire data collection mechanism. In this paper, a fog computing-based smart farming framework is proposed that utilizes UAVs to gather data from IoT sensors deployed in farms and offloads it at fog sites deployed at the network edge. The framework adopts the concept of a charging token, where upon completing a trip, UAVs receive tokens from the fog node. These tokens can later be redeemed to charge the UAVs for their subsequent trips. An intrusion detection system is deployed at the fog nodes that utilize machine learning models to classify UAV behavior as malicious or benign. In the case of malicious classification, the fog node reduces the tokens, resulting in the UAV not being able to charge fully for the duration of the trip. Thus, such UAVs are automatically eliminated from the UAV pool. The results show a 99.7% accuracy in detecting intrusions. Moreover, due to token-based elimination, the system is able to conserve energy. The evaluation of CPU and memory usage benchmarks indicates that the system is capable of efficiently collecting smart-farm data, even in the presence of attacks.

The aim of this paper is to address the current situation where business units in smart grid (SG) environments are decentralized and independent, and there is a conflict between the need for data privacy protection and network security monitoring. To address this issue, we propose a distributed intrusion detection method based on convolutional neural networks–gated recurrent units–federated learning (CNN–GRU–FL). We designed an intrusion detection model and a local training process based on convolutional neural networks–gated recurrent units (CNN–GRU) and enhanced the feature description ability by introducing an attention mechanism. We also propose a new parameter aggregation mechanism to improve the model quality when dealing with differences in data quality and volume. Additionally, a trust-based node selection mechanism was designed to improve the convergence ability of federated learning (FL). Through experiments, it was demonstrated that the proposed method can effectively build a global intrusion detection model among multiple independent entities, and the training accuracy rate, recall rate, and F1 value of CNN–GRU–FL reached 78.79%, 64.15%, and 76.90%, respectively. The improved mechanism improves the performance and efficiency of parameter aggregation when there are differences in data quality.

A cyber-physical system (CPS) can be referred to as a network of cyber and physical components that communicate with each other in a feedback manner. A CPS is essential for daily activities and approves critical infrastructure as it provides the base for innovative smart devices. The recent advances in the field of explainable artificial intelligence have contributed to the development of robust intrusion detection modes for CPS environments. This study develops an Explainable Artificial Intelligence Enabled Intrusion Detection Technique for Secure Cyber-Physical Systems (XAIID-SCPS). The proposed XAIID-SCPS technique mainly concentrates on the detection and classification of intrusions in the CPS platform. In the XAIID-SCPS technique, a Hybrid Enhanced Glowworm Swarm Optimization (HEGSO) algorithm is applied for feature selection purposes. For intrusion detection, the Improved Elman Neural Network (IENN) model was utilized with an Enhanced Fruitfly Optimization (EFFO) algorithm for parameter optimization. Moreover, the XAIID-SCPS technique integrates the XAI approach LIME for better understanding and explainability of the black-box method for accurate classification of intrusions. The simulation values demonstrate the promising performance of the XAIID-SCPS technique over other approaches with maximum accuracy of 98.87%.

Recent research has given sufficient attention to intrusion detection as one of the most significant techniques to guaranteeing wireless sensing network security. However, with the advent of electronic anti-reconnaissance equipment, the intruder may learn the precise locations of detecting nodes and then use proposed system data to plot a course that will take him or her past them undetected. Such a threat is characterized as an empowered invader who poses novel difficulties for existing intrusion detection techniques. When detection nodes are first deployed at random, coverage gaps may appear in certain places, making it impossible to achieve the intended detection impact. To combat these problems, we provide a concept for a sensing network in which cars work together to offer intrusion detection against armed attackers. Our solution incorporates a sleep-scheduling technique for stationary nodes and an algorithm for mobile sensing devices to pursue targets. To close the coverage gaps, mobile monitoring devices will follow the empowered intruder, meanwhile static nodes will adhere to a sleep-scheduling algorithm and be roused by neighboring detection nodes. To evaluate the efficacy of our concept in terms of intrusion detection, energy consumption, and the range over which sensor nodes may move, we conduct simulation experiments against established methods. Extensive simulations are also run to examine the sensitivity of the parameters. Our idea has been shown to be more efficient and available through theoretical research and simulation.

Nowadays, in order to improve the routine activities, interoperability andinterconnectivityof computing systems are extensively used. In addition, it creates a way to vulnerabilities that are far beyond the reach of human control. Due to the vulnerabilities, data transfer must include cyber-security measures. Secure connectivity demands improvements to security mechanisms to counter emerging security risks and security systems to mitigate the threats. This paper proposes Intrusion Detection by Stacked Deep Ensemble Model (IDSDEM) which has three working stages. Initially, in the pre-processing stage, data normalization process is conducted to reduce the data redundancy and increases the consistency of data for further process. Afterwards feature extraction stage takes place where the features such as entropy based as well as improved correlation based features were extracted. Finally, intrusion detection is conducted where a stacked deep ensemble model which includes the classifiers like Deep Belief Network (DBN), Deep Maxout Network and Customized Convolutional Neural Network (CCNN) is employed to provide effective intrusion detection. The outcomes demonstrated that the developed IDSDEM can offer superior performance with respect to detection accuracy, precision and other measures.

Recently proposed methods in intrusion detection are iterating on machine learning methods as a potential solution. These novel methods are validated on one or more datasets from a sparse collection of academic intrusion detection datasets. Their recognition as improvements to the state-of-the-art is largely dependent on whether they can demonstrate a reliable increase in classification metrics compared to similar works validated on the same datasets. Whether these increases are meaningful outside of the training/testing datasets is rarely asked and never investigated. This work aims to demonstrate that strong general performance does not typically follow from strong classification on the current intrusion detection datasets. Binary classification models from a range of algorithmic families are trained on the attack classes of CSE-CIC-IDS2018, a state-of-the-art intrusion detection dataset. After establishing baselines for each class at various points of data access, the same trained models are tasked with classifying samples from the corresponding attack classes in CIC-IDS2017, CIC-DoS2017 and CIC-DDoS2019. Contrary to what the baseline results would suggest, the models have rarely learned a generally applicable representation of their attack class. Stability and predictability of generalized model performance are central issues for all methods on all attack classes. Focusing only on the three best-in-class models in terms of interdataset generalization, reveals that for network-centric attack classes (brute force, denial of service and distributed denial of service), general representations can be learned with flat losses in classification performance (precision and recall) below 5%. Other attack classes vary in generalized performance from stark losses in recall (−35%) with intact precision (98+%) for botnets to total degradation of precision and moderate recall loss for Web attack and infiltration models. The core conclusion of this article is a warning to researchers in the field. Expecting results of proposed methods on the test sets of state-of-the-art intrusion detection datasets to translate to generalized performance is likely a serious overestimation. Four proposals to reduce this overestimation are set out as future work directions.

Cloud security vulnerabilities have recently become more prevalent around the world, posing a threat to cloud service providers' (CSPs) ability to respond to client demands. In cloud market, the requests are announced by the client nodes to their CSP. A malicious node can alter a client's request, resulting in the next cloud market collapse, decreased reliability, and data leaking.To identify malicious nodes in the cloud market, a novel fuzzy multiple criterion decision making scheme is suggested. Authentication test, trust level, traffic size, and node activity levels are all taken into consideration simultaneously as the major criteria for identifying malicious nodes. For each node, the CSP uses fuzzy Integral to generate a composite value based on these criteria. The malicious node is then removed from the cloud market using this composite value. The simulation results demonstrated the potential of the proposed method to prevent nodes in the cloud market from running malware or software that can be used to degrade quality of service by exhausting resources in the cloud market.

Machine Learning (ML) based Network Intrusion Systems (NIDSs) operate on flow features which are obtained from flow exporting protocols (i.e., NetFlow). Recent success of ML and Deep Learning (DL) based NIDS solutions assume such flow information (e.g., avg. packet size) is obtained from all packets of the flow. However, often in practice flow exporter is deployed on commodity devices where packet sampling is inevitable. As a result, applicability of such ML based NIDS solutions in the presence of sampling (i.e., when flow information is obtained from sampled set of packets instead of full traffic) is an open question. In this study, we explore the impact of packet sampling on the performance and efficiency of ML-based NIDSs. Unlike previous work, our proposed evaluation procedure is immune to different settings of flow export stage. Hence, it can provide a robust evaluation of NIDS even in the presence of sampling. Through sampling experiments we established that malicious flows with shorter size (i.e., number of packets) are likely to go unnoticed even with mild sampling rates such as 1/10 and 1/100. Next, using the proposed evaluation procedure we investigated the impact of various sampling techniques on NIDS detection rate and false alarm rate. Detection rate and false alarm rate is computed for three sampling rates (i.e., 1/10, 1/100, 1/1000), for four different sampling techniques and for three (two tree-based, one deep learning based) classifiers. Experimental results show that systematic linear sampler - SketFlow performs better compared to non-linear samplers such as Sketch Guided and Fast Filtered sampling. We also found that random forest classifier with SketchFlow sampling was a better combination. The combination showed higher detection rate and lower false alarm rate across multiple sampling rates compared to other sampler-classifier combinations. Our results are consistent in multiple sampling rates, exceptional case is observed for Sketch Guided Sampling (SGS) as it caused a drastic performance drop when sampling rate was changed from 1/100 to 1/1000. Our results provide valuable insights for network practitioners and researchers regarding on how packet sampling effects ML-based NIDS performance. In this regard full source code for sampling and ML experiments has been released: github.com/Jumabek/sampledFlowMeter and github.com/Jumabek/nids-with-sampling

Network spoofing is becoming a common attack in wireless networks. The trend is going high due to an increase in Internet users. Similarly, there is a rapid growth of numbers in mobile devices in the working environments and on most official occasions. The trends pose a huge threat to users since they become the prime target of attackers. More unfortunately, mobile devices have weak security measures due to their limited computational powers. Current approaches to detect spoofing attacks focus on personal computers and rely on the network hosts’ capacity, leaving guest users with mobile devices at risk. Some approaches on Android-based devices demand root privilege, which is highly discouraged. This paper presents an Android-based client-side solution to detect the presence of fake access points in a perimeter using details collected from probe responses. Our approach considers the difference in security information and signal level of an access point (AP). We present the detection in three networks, (i) open networks, (ii) closed networks and (iii) networks with captive portals. As a departure from existing works, our solution does not require root access for detection, and it is developed for portability and better performance. Experimental results show that our approach can detect fake access points with an accuracy of 99% and 99.7% at an average of 24.64 and 7.78 milliseconds in open and closed networks, respectively.

With recent advancements in the automotive world and the introduction of autonomous vehicles, automotive security has become a real and important issue. Modern vehicles have tens of Electronic Control Units (ECUs) connected to in-vehicle networks. As a de facto standard for in-vehicle network communication, the Controller Area Network (CAN) has become a target of cyber attacks. Anomaly-based Intrusion Detection System (IDS) is considered as an effective approach to secure CAN and detect malicious attacks. Currently, there are two primary approaches used for intrusion detection: rule-based and machine learning-based. Rule-based approach is efficient but limited in the detection accuracy while machine learning-based detection has comparably higher detection accuracy but higher computation cost at the same time. In this paper, we propose a novel hybrid IDS that combines the benefits of both rule-based and machine learning-based approaches. More specifically, we use machine learning methods to achieve a high detection rate while keeping the low computational requirement by offsetting the detection with a rule-based component. Our experiments with CAN traces collected from four different vehicle models demonstrate the effectiveness and efficiency of the proposed hybrid IDS.

As a result of the explosion of security attacks and the complexity of modern networks, machine learning (ML) has recently become the favored approach for intrusion detection systems (IDS). However, the ML approach usually faces three challenges: massive attack variants, imbalanced data issues, and appropriate data segmentation. Improper handling of the issues will significantly degrade ML performance, e.g., resulting in high false-negative and low recall rates. Despite many efforts have done in the literature, detecting security attacks in a complicated network environment with imperfect data collection is still an open issue. This work proposes a machine learning framework with a combination of a variational autoencoder and multilayer perceptron model to deal with imbalanced datasets and detect the explosion of attack variants on the Internet. The detection engine also includes an efficient range-based sequential search algorithm to address the segmentation challenge in data pre-processing from multiple sources (network packets, system/statistic logs) effectively. Our work is the first attempt to demonstrate the effect of using an appropriate combination of ML models for boosting IDS detection capability in a heterogeneous environment, where data collection imperfection is common. Experimental results on a public system log dataset (e.g., HDFS) show that our method gains approximately as much as 97% on F1 score and 98% on recall rate, a promising result compared to the same measurement of other solutions. Even better, we found that the proposed treatment of imbalanced datasets can improve up to 35% on the F1 score and 27% on recall rate. The testing results also indicate that our model can detect new attack variants.

Attacks launched over the Internet often degrade or disrupt the quality of online services. Various Intrusion Detection Systems (IDSs), with or without prevention capabilities, have been proposed to defend networks or hosts against such attacks. While most of these IDSs extract features from the packet headers to detect any irregularities in the network traffic, some others use payloads alongside the headers. In this study, we propose a payload-based intrusion detection scheme, PayloadEmbeddings, using byte embeddings of the payloads of network packets. We employ a shallow neural network to generate vector representations for bytes and their corresponding payloads. Our feature extraction technique is coupled with the $k$ -Nearest Neighbours ( $k$ NN) algorithm for the classification of packets as intrusive or non-intrusive. In our experiments, we evaluated 34 publicly available datasets, and used ten distinct payload-based, labeled intrusion detection datasets to train and evaluate our approach. Our empirical results show that PayloadEmbeddings reaches between 75% and 99% accuracy across all datasets. Finally, we compare our approach to other state-of-the-art and traditional intrusion detection techniques. Our findings suggest that PayloadEmbeddings demonstrates significant advantages over the other techniques on most of the datasets.

Intrusion detection system plays an important role in network security. Early detection of the potential attacks can prevent the further network intrusion from adversaries. To improve the effectiveness of the intrusion detection rate, this paper proposes a hybrid intrusion detection method that utilizes ADASYN (Adaptive Synthetic) and the decision tree based on ID3 algorithm. At first, the intrusion detection dataset is transformed by coding technology and normalized. Subsequently, the ADASYN algorithm is applied to implement oversampling on the training set, and the ID3 algorithm is employed to build a decision tree model. In addition, the model proposed by the research is evaluated by accuracy, precision, recall, and false alarm rate. Besides, a performance comparison is conducted with other models. Consequently, it is found that the combined model based on ADASYN and ID3 decision tree proposed in this research possesses higher accuracy as well as lower false alarm rate, which is more suitable for intrusion detection tasks.

Intrusion detection systems (IDS) are amongst the most important automated defense mechanisms in modern industry. It is guarding against many attack vectors, especially in healthcare, where sensitive information (patient’s medical history, prescriptions, electronic health records, medical bills/debts, and many other sensitive data points) is open to compromise from adversaries. In the big data era, classical machine learning has been applied to train IDS. However, classical IDS tend to be complex: either using several hidden layers susceptible to over-fitting on training data or using overly complex architectures such as convolutional neural networks (CNNs), long-short term memory systems (LSTMs), and recurrent neural networks (RNNs). This paper explored the combination of principles of quantum mechanics and neural networks to train IDS. A hybrid classical-quantum neural architecture is proposed with a quantum-assisted activation function that successfully captures patterns in the dataset while having less architectural memory footprint than classical solutions. The experimental results are demonstrated on the popular KDD99 dataset while comparing our solution to other classical models.

In recent years, the high improvement in communication, Internet of Things (IoT) and cloud computing have begun complex questioning in security. Based on the development, cyberattacks can be increased since the present security techniques do not give optimal solutions. As a result, the authors of this paper created filter-based ensemble feature selection (FEFS) and employed a deep learning model (DLM) for cloud computing intrusion detection. Initially, the intrusion data were collected from the global datasets of KDDCup-99 and NSL-KDD. The data were utilized for validation of the proposed methodology. The collected database was utilized for feature selection to empower the intrusion prediction. The FEFS is a combination of three feature extraction processes: filter, wrapper and embedded algorithms. Based on the above feature extraction process, the essential features were selected for enabling the training process in the DLM. Finally, the classifier received the chosen features. The DLM is a combination of a recurrent neural network (RNN) and Tasmanian devil optimization (TDO). In the RNN, the optimal weighting parameter is selected with the assistance of the TDO. The proposed technique was implemented in MATLAB, and its effectiveness was assessed using performance metrics including sensitivity, F measure, precision, sensitivity, recall and accuracy. The proposed method was compared with the conventional techniques such as an RNN and deep neural network (DNN) and RNN–genetic algorithm (RNN-GA), respectively.

An Intrusion Detection Model (IDM) using a Machine Learning (ML) algorithm on a Big Data environment is a method for identifying and preventing unauthorized access to a computer system. The IDM utilizes a ML algorithm to analyze large sets of data, or “Big Data,” in order to identify patterns and anomalies that may indicate a security breach. These patterns and anomalies are then used to create a model that can detect intrusions in real-time. The use of a Big Data environment allows for the IDM to process and analyze large amounts of data quickly and accurately, making it more effective at detecting and preventing intrusions. This approach can be used in a variety of industries, including finance, healthcare, and government, to improve the security of sensitive informationis compared to the Chi Logistic Regression classifier and the results show that the Spark Chi SVM model has a high performance, reduces training time and is efficient for handling Big Data.

Industrial Cyber-Physical Systems (ICPS) connect intelligent manufacturing equipment equipped with sensors, wireless and RFID communication technologies through data interaction, which makes the interior of the factory, even between factories, become a whole. However, intelligent factories will suffer information leakage and equipment damage when being attacked by ICPS intrusion. Therefore, the network security of ICPS cannot be ignored, and researchers have conducted in-depth research on network intrusion detection for ICPS. Though machine learning and deep learning methods are often used for network intrusion detection, the problem of data imbalance can cause the model to pay attention to the misclassification cost of the prevalent class, but ignore that of the rare class, which seriously affects the classification performance of network intrusion detection models. Considering the powerful generative power of the diffusion model, we propose an ICPS Intrusion Detection system based on the Diffusion model (IDD). Firstly, data corresponding to the rare class is generated by the diffusion model, which makes the training dataset of different classes balanced. Then, the improved BiLSTM classification network is trained on the balanced training set. Extensive experiments are conducted to show that the IDD method outperforms the existing baseline method on several available datasets.

Owing to the prevalence of the Internet of things (IoT) devices connected to the Internet, the number of IoT-based attacks has been growing yearly. The existing solutions may not effectively mitigate IoT attacks. In particular, the advanced network-based attack detection solutions using traditional Intrusion detection systems are challenging when the network environment supports traditional as well as IoT protocols and uses a centralized network architecture such as a software defined network (SDN). In this paper, we propose a long short-term memory (LSTM) based approach to detect network attacks using SDN supported intrusion detection system in IoT networks. We present an extensive performance evaluation of the machine learning (ML) and deep learning (DL) model in two SDNIoT-focused datasets. We also propose an LSTM-based architecture for the effective multiclass classification of network attacks in IoT networks. Our evaluation of the proposed model shows that our model effectively identifies the attacks and classifies the attack types with an accuracy of 0.971. In addition, various visualization methods are shown to understand the dataset’s characteristics and visualize the embedding features.

This manuscript explores the problem of deploying sensors in networks to detect intrusions as effectively as possible. In water distribution networks, intrusions can cause a spread of contaminants over the whole network; we are searching for locations for where to install sensors in order to detect intrusion contaminations as early as possible. Monitoring epidemics can also be modelled into this framework. Given a network of interactions between people, we want to identify which “small” set of people to monitor in order to enable early outbreak detection. In the domain of the Web, bloggers publish posts and refer to other bloggers using hyperlinks. Sensors are a set of blogs that catch links to most of the stories that propagate over the blogosphere. In the sensor placement problem, we have to manage a trade-off between different objectives. To solve the resulting multi-objective optimization problem, we use a multi-objective evolutionary algorithm based on the Tchebycheff scalarization (MOEA/D). The key contribution of this paper is to interpret the weight vectors in the scalarization as probability measures. This allows us to use the Wasserstein distance to drive their selection instead of the Euclidean distance. This approach results not only in a new algorithm (MOEA/D/W) with better computational results than standard MOEA/D but also in a new design approach that can be generalized to other evolutionary algorithms.

In an Industry 4.0 ecosystem, all the essential components are digitally interconnected, and automation is integrated for higher productivity. However, it invites the risk of increasing cyber-attacks amid the current cyber explosion. The identification and monitoring of these malicious cyber-attacks and intrusions need efficient threat intelligence techniques or intrusion detection systems (IDSs). Reducing the false positive rate in detecting cyber threats is an important step for a safer and reliable environment in any industrial ecosystem. Available approaches for intrusion detection often suffer from high computational costs due to large number of feature instances. Therefore, this paper proposes a novel unsupervised IDS for Industry 4.0 which we term as: Unsupervised Intrusion Detection System for Industry 4.0 (UInDeSI4.0). We have substantiated the proposed UInDeSI4.0 approach through its experimentation on the well-known UNSW-NB15 Industry 4.0 dataset. The proposed UInDeSI4.0 employs feature selection approaches to obtain minimal and optimal features. These features are then used to train isolation forest to detect network traffic threats in an unsupervised manner. Accordingly, the proposed UInDeSI4.0 approach can efficiently differentiate between the normal events and the attacks or intrusions in environments with no label information. Experimental results show that the proposed UInDeSI4.0 provides better accuracy (63%) and a minimal feature set (nine) compared to traditional IDSs. In contrast to deep learning approaches, UInDeSI4.0 generates faster results with minimum features. In conclusion, we establish the superiority of UInDeSI4.0 approach as an accurate and computationally efficient IDS for Industry 4.0. peerReviewed

The file attached to this record is the author's final peer reviewed version. The Publisher's final version can be found by following the DOI link. The recent increase in cybersecurity threats and cyberattacks impact organizations at various levels, including business-critical processes, and compromises business continuation and organizations survival. The cybersecurity of the healthcare sector, considered in many countries as critical national infrastructure, is addressed with particular interest, and focus in this study. We propose an integrated cybersecurity methodology and supporting tools for healthcare operational information systems. The artifact named Cyber.SCuris is developed to complement cyber threat intelligence and incident response life cycle and standards such as NIST SP800. The proposed methodology and supporting tools are designed to operate in critical networks and medical contexts, to detect unexpected behavior and prevent cybersecurity breaches in areas as sensitive as the clinical process of healthcare institutions operational information systems. We present an use case based demonstration scenario, integrating medical practice systems, such as a Picture Archiving and Communication System (Orthanc Server/ONIS Viewer software using the Digital Imaging and Communications in Medicine standard), a Security Information and Event Management system (Splunk software) and an Incident Handling and Resolution System (TheHive software), illustrating the adoption of the methodology and corresponding tools, for incident response life cycle management in the context of cyberattacks to healthcare institutions infrastructures. The methodology is adjustable, technology agnostic, and customizable to the integration of more and different systems, according to business/information systems processes, and maturity of healthcare institutions. This work benefited from organizational, technical and industry standards guidance and advise from a Portuguese university medical center.

Deploying Connected and Automated Vehicles (CAVs) on top of 5G and Beyond networks (5GB) makes them vulnerable to increasing vectors of security and privacy attacks. In this context, a wide range of advanced machine/deep learning-based solutions have been designed to accurately detect security attacks. Specifically, supervised learning techniques have been widely applied to train attack detection models. However, the main limitation of such solutions is their inability to detect attacks different from those seen during the training phase, or new attacks, also called zero-day attacks. Moreover, training the detection model requires significant data collection and labeling, which increases the communication overhead, and raises privacy concerns. To address the aforementioned limits, we propose in this paper a novel detection mechanism that leverages the ability of the deep auto-encoder method to detect attacks relying only on the benign network traffic pattern. Using federated learning, the proposed intrusion detection system can be trained with large and diverse benign network traffic, while preserving the CAVs’ privacy, and minimizing the communication overhead. The in-depth experiment on a recent network traffic dataset shows that the proposed system achieved a high detection rate while minimizing the false positive rate, and the detection delay., Le déploiement de véhicules connectés et automatisés (CAV) utilisant les réseaux 5G et 5G-B les rend vulnérables à de nouveaux vecteurs d'attaques. Afin de détecter et de mitiger ces attaques, plusieurs systèmes de détection d'intrusions (IDS) basés sur l'apprentissage automatique ont été proposés, dont la grande majorité utilise l'apprentissage profond supervisé. Cependant, la principale limite de ce type de solution est son incapacité à détecter des attaques différentes de celles vues lors de l'apprentissage de l'IDS, ou de nouvelles attaques, également appelées attaques Zero-day. De plus, l'apprentissage du modèle de détection nécessite une collecte et un étiquetage importants des données, ce qui augmente le coût de communication et soulève des problèmes de confidentialité. Afin de pallier ces problèmes, nous proposons dans cet article un nouveau IDS basé sur l'apprentissage fédéré non supervisé préservant la confidentialité, et dont l'apprentissage du système ne nécessite que le trafic réseau légitime. L'expérimentation de la solution proposée sur un jeu de données récent montre que le système proposé présente un taux de détection élevé tout en minimisant le taux de faux positifs et le délai de détection.

Generalization is a longstanding assumption in articles concerning network intrusion detection through machine learning. Novel techniques are frequently proposed and validated based on the improvement they attain when classifying one or more of the existing datasets. The necessary follow-up question of whether this increased performance in classification is meaningful outside of the dataset(s) is almost never investigated. This lacuna is in part due to the sparse dataset landscape in network intrusion detection and the complexity of creating new data. The introduction of two recent datasets, namely CIC-IDS2017 and CSE-CIC-IDS2018, opened up the possibility of testing generalization capability within similar academic datasets. This work investigates how well models from different algorithmic families, pretrained on CICIDS2017, are able to classify the samples in CSE-CIC-IDS2018 without retraining. Earlier work has shown how robust these models are to data reduction when classifying state-of-the-art datasets. This work experimentally demonstrates that the implicit assumption that strong generalized performance naturally follows from strong performance on a specific dataset is largely erroneous. The supervised machine learning algorithms suffered flat losses in classification performance ranging from 0 to 50% (depending on the attack class under test). For non-network-centric attack classes, this performance regression is most pronounced, but even the less affected models that classify the network-centric attack classes still show defects. Current implementations of intrusion detection systems (IDSs) with supervised machine learning (ML) as a core building block are thus very likely flawed if they have been validated on the academic datasets, without the consideration for their general performance on other academic or real-world datasets.

The widespread use of interoperability and interconnectivity of computing systems is becoming indispensable for enhancing our day-to-day actions. The susceptibilities deem cyber-security systems necessary for assuming communication interchanges. Secure transmission needs security measures for combating the threats and required developments to security measures that counter evolving security risks. Though firewalls were devised to secure networks, in real-time they cannot detect intrusions. Hence, destructive cyber-attacks put forward severe security complexities, requiring reliable and adaptable intrusion detection systems (IDS) that could monitor unauthorized access, policy violations, and malicious activity practically. Conventional machine learning (ML) techniques were revealed for identifying data patterns and detecting cyber-attacks IDSs successfully. Currently, deep learning (DL) methods are useful for designing accurate and effective IDS methods. In this aspect, this study develops an intelligent IDS using enhanced arithmetic optimization algorithm with deep learning (IIDS-EAOADL) method. The presented IIDS-EAOADL model performs data standardization process to normalize the input data. Besides, equilibrium optimizer based feature selection (EOFS) approach is developed to elect an optimal subset of features. For intrusion detection, deep wavelet autoencoder (DWAE) classifier is applied. Since the proper tuning of parameters of the DWNN is highly important, EAOA algorithm is used to tune them. For assuring the simulation results of the IIDS-EAOADL technique, a widespread simulation analysis takes place using a benchmark dataset. The experimentation outcomes demonstrate the improvements of the IIDS-EAOADL model over other existing techniques

Data availability: Data is available on reasonable request. ... ...

Detecting outliers in real-time is increasingly important for many real-world applications such as detecting abnormal heart activity, intrusions to systems, spams or abnormal credit card transactions. However, detecting outliers in data streams rises many challenges such as high-dimensionality, dynamic data distribution and unpredictable relationships. Our simulations demonstrate that some advanced solutions still show drawbacks. In this paper, first, we improve the capacity to detect outliers of both micro-clusters based algorithms (MCOD) and distance-based algorithms (Abstract-C and Exact-Storm) known for their performance. This is by adding a layer called LiCS that classifies online the K-nearest-neighbors (Knn) of each node based on their evolutionary status. This layer aggregates the results and uses a count threshold to better classify nodes. Experiments on SpamBase datasets confirmed that our technique enhances the accuracy and the precision of such algorithm and helps to reduce the unclassified nodes.Second, we propose a hybrid solution based on iterative majority voting and our LiCS. Experiments on real data proves that it outperforms discussed algorithms in terms of accuracy, precision and sensitivity in detecting outliers. It also minimizes the issue of unclassified instances and consolidate the different outputs of algorithms.

Intrusion detection acts as a vital function in providing information security, and additionally the key technology is to precisely classify diverse attacks. Intrusion detection system (IDS) is identified as an important security issue within the cloud network environment. In this paper, IDS is given based on an innovative optimized custom RC-NN (Recurrent Convolutional Neural Network) which is proposed for intrusion detection along with the Ant Lion optimization algorithm. By this method, CNN (Convolutional Neural Network) is made hybrid with LSTM (Long Short Term Memory). Thus, all the attacks identified with the network layer of cloud are classified efficiently. The experimental results shown below describe the presentation of the IDS classification model with high accuracy, thus improving the detection rate or error rate. The optimized custom RC-NN-IDS model thus achieved an improved classification accuracy of 94% and also a decreased error rate of 0.0012. Additionally true positive rate, true negative rate and precision are considered as performance metrics. The proposed approach is evaluated using the DARPA IDS evaluation Data Sets and CSE-CIC-IDS2018 dataset and is compared with some existing approaches.

The Industrial Internet of Things (IIoT) has become very popular in recent years. However, IIoT is still an attractive and vulnerable target for attackers to exploit and experiment with different types of attacks. To confront this problem, the research community began exploring novel systems to protect the network. However, there are concerns related to some of theses systems regarding the increasing levels of required human interaction, which impact their efficiency. Recently, machine learning techniques are gaining much interest in security applications as they exhibit fast processing capabilities with real-time predictions. One of the significant challenges in the implementation of these techniques is the available training data for each new potential attack category, which is most of the time, unfeasible. Hence, these techniques might suffer from low detection rates for the attacks with relatively small training data (minority classes). In this article, we propose a novel algorithm based on machine learning to alleviate the class imbalance problem by computing an optimized weight for each machine learning-based decision. In particular, a supervised machine learning algorithm is first used to classify the attack categories for each node. The decisions made by the machine learning classifier are then stored in a private database. A specially designed best effort iterative weighted attack classification algorithm exploits this collected data to enhance the accuracy of the rarely detectable attack types. For each class, the weight that maximizes the diagonal to maximum ratios of the confusion matrix is iteratively computed. Such approach is shown to enhance the overall classification performance and detection accuracy even for the rarely detectable classes. Both the UNSW and NSL-KDD datasets are used in this article to validate the proposed model and verify its efficiency in detecting intrusions. The simulation results show that the proposed model can effectively detect intrusion attacks with a higher detection rate and the lowest false alarm rate compared to the state-of-the-art techniques. 2007-2012 IEEE. Qatar Foundation;Qatar National Research Fund Scopus

[Introduction] Aiming at the current problems of the continuous update of the security requirements and low efficiency and uncontrollable effects of security rectification on-site operations for the power monitoring system, and the status quo of large area off-grid operation of some secondary equipment without effective rectification methods, secondary equipment centralized security operation and maintenance and key technologies of active perception, diagnosis and early warning are studied. [Method] Compliant grid-connected devices were unified deployed in substations, the technologies of deep belief nets multi-class support vector machine intrusion detection and adaptive probabilistic marking scheme IP traceback were used to filter recording data, active percept and retrospective diagnosis invaded threats, the risk early warning and comprehensive assessment technology based on combining with threat and adversarial analysis were adopted to carry out impact assessment and rating, and the existing recording master station system was used to expand the security operation and maintenance management business to form centralized operation and maintenance management model. [Result] Practical results show that this method can achieve the goals that the security system of substation secondary equipment is centralized managed and efficiency of operation and maintenance is higher. [Conclusion] The proposed method is effective and feasible to solve the problem of on-site security rectification of secondary equipment combined with the Guangxi power grid operation case.