The rapid advances in the internet and communication fields have resulted in a huge increase in the network size and the corresponding data. As a result, many novel attacks are being gener...

https://onlinelibrary.wiley.com/doi/pdf/10.1002/ett.4150

Network Intrusion Detection System: A systematic study of Machine Learning and Deep Learning approaches

An effective convolutional neural network based on SMOTE and Gaussian mixture model for intrusion detection in imbalanced dataset

The Internet of Things (IoT) has lately developed into an innovation for developing smart environments. Security and privacy are viewed as main problems in any technology’s dependence on the IoT model. Privacy and security issues arise due to the different possible attacks caused by intruders. Thus, there is an essential need to develop an intrusion detection system for attack and anomaly identification in the IoT system. In this work, we have proposed a deep learning-based method Deep Belief Network (DBN) algorithm model for the intrusion detection system. Regarding the attacks and anomaly detection, the CICIDS 2017 dataset is utilized for the performance analysis of the present IDS model. The proposed method produced better results in all the parameters in relation to accuracy, recall, precision, F1-score, and detection rate. The proposed method has achieved 99.37% accuracy for normal class, 97.93% for Botnet class, 97.71% for Brute Force class, 96.67% for Dos/DDoS class, 96.37% for Infiltration class, 97.71% for Ports can class and 98.37% for Web attack, and these results were compared with various classifiers as shown in the results.

Effective Attack Detection in Internet of Medical Things Smart Environment Using a Deep Belief Neural Network

An effective intrusion detection approach using SVM with naïve Bayes feature embedding

Deep learning (DL) is an efficient method for botnet attack detection. However, the volume of network traffic data and memory space required is usually large. It is, therefore, almost impossible to implement the DL method in memory-constrained Internet-of-Things (IoT) devices. In this article, we reduce the feature dimensionality of large-scale IoT network traffic data using the encoding phase of long short-term memory autoencoder (LAE). In order to classify network traffic samples correctly, we analyze the long-term inter-related changes in the low-dimensional feature set produced by LAE using deep bidirectional long short-term memory (BLSTM). Extensive experiments are performed with the BoT-IoT data set to validate the effectiveness of the proposed hybrid DL method. Results show that LAE significantly reduced the memory space required for large-scale network traffic data storage by 91.89%, and it outperformed state-of-the-art feature dimensionality reduction methods by 18.92–27.03%. Despite the significant reduction in feature size, the deep BLSTM model demonstrates robustness against model underfitting and overfitting. It also achieves good generalisation ability in binary and multiclass classification scenarios.

/pdf/hybrid-deep-learning-for-botnet-attack-detection-in-the-1ygf68htdv.pdf

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

The security of networked systems has become a critical universal issue that influences individuals, enterprises and governments. The rate of attacks against networked systems has increased dramatically, and the tactics used by the attackers are continuing to evolve. Intrusion detection is one of the solutions against these attacks. A common and effective approach for designing Intrusion Detection Systems (IDS) is Machine Learning. The performance of an IDS is significantly improved when the features are more discriminative and representative. This study uses two feature dimensionality reduction approaches: (i) Auto-Encoder (AE): an instance of deep learning, for dimensionality reduction, and (ii) Principle Component Analysis (PCA). The resulting low-dimensional features from both techniques are then used to build various classifiers such as Random Forest (RF), Bayesian Network, Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) for designing an IDS. The experimental findings with low-dimensional features in binary and multi-class classification show better performance in terms of Detection Rate (DR), F-Measure, False Alarm Rate (FAR), and Accuracy. This research effort is able to reduce the CICIDS2017 dataset’s feature dimensions from 81 to 10, while maintaining a high accuracy of 99.6% in multi-class and binary classification. Furthermore, in this paper, we propose a Multi-Class Combined performance metric C o m b i n e d M c with respect to class distribution to compare various multi-class and binary classification systems through incorporating FAR, DR, Accuracy, and class distribution parameters. In addition, we developed a uniform distribution based balancing approach to handle the imbalanced distribution of the minority class instances in the CICIDS2017 network intrusion dataset.

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

Despite the successful contributions in the field of network intrusion detection using machine learning algorithms and deep networks to learn the boundaries between normal traffic and network attacks, it is still challenging to detect various attacks with high performance. In this paper, we propose a novel mathematical model for further development of robust, reliable, and efficient software for practical intrusion detection applications. In this present work, we are concerned with optimal hyperparameters tuned for high performance sparse autoencoders for optimizing features and classifying normal and abnormal traffic patterns. The proposed framework allows the parameters of the back-propagation learning algorithm to be tuned with respect to the performance and architecture of the sparse autoencoder through a sequence of trigonometric simplex designs. These hyperparameters include the number of nodes in the hidden layer, learning rate of the hidden layer, and learning rate of the output layer. It is expected to achieve better results in extracting features and adapting to various levels of learning hierarchy as different layers of the autoencoder are characterized by different learning rates in the proposed framework. The idea is viewed such that every learning rate of a hidden layer is a dimension in a multidimensional space. Hence, a vector of the adaptive learning rates is implemented for the multiple layers of the network to accelerate the processing time that is required for the network to learn the mapping towards a combination of enhanced features and the optimal synaptic weights in the multiple layers for a given problem. The suggested framework is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyber-attacks. Experimental results demonstrate that the proposed architecture for intrusion detection yields superior performance compared to recently published algorithms in terms of classification accuracy and F-measure results.

https://www.mdpi.com/2079-9292/9/2/259/pdf

An Enhanced Design of Sparse Autoencoder for Latent Features Extraction Based on Trigonometric Simplexes for Network Intrusion Detection Systems

Designing a machine learning based network intrusion detection system (IDS) with high-dimensional features can lead to prolonged classification processes. This is while low-dimensional features can reduce these processes. Moreover, classification of network traffic with imbalanced class distributions has posed a significant drawback on the performance attainable by most well-known classifiers. With the presence of imbalanced data, the known metrics may fail to provide adequate information about the performance of the classifier. This study first uses Principal Component Analysis (PCA) as a feature dimensionality reduction approach. The resulting low-dimensional features are then used to build various classifiers such as Random Forest (RF), Bayesian Network, Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) for designing an IDS. The experimental findings with low-dimensional features in binary and multi-class classification show better performance in terms of Detection Rate (DR), F-Measure, False Alarm Rate (FAR), and Accuracy. Furthermore, in this paper, we apply a Multi-Class Combined performance metric Combi ned Mc with respect to class distribution through incorporating FAR, DR, Accuracy, and class distribution parameters. In addition, we developed a uniform distribution based balancing approach to handle the imbalanced distribution of the minority class instances in the CICIDS2017 network intrusion dataset. We were able to reduce the CICIDS2017 dataset's feature dimensions from 81 to 10 using PCA, while maintaining a high accuracy of 99.6% in multi-class and binary classification.

Efficient Network Intrusion Detection Using PCA-Based Dimensionality Reduction of Features

We propose a free selective simplex for the downhill Nelder Mead simplex algorithm (1965), rather than the determinant simplex that forces its elements to perform a single operation, such as reflection. Unlike the Nelder-Mead algorithm, the elements of the proposed simplex select various operations of the algorithm to form the next simplex. In this way, we allow non-isometric reflections similar to that of the Nelder Mead, triangle simplex, but with rotation through an angle, permitting the proposed algorithm to have more control over the simplex, to change its size and direction for better performance. As a consequence, the solution that comes from the proposed simplex is always dynamic adaptive in size and orientation to different landscapes of mathematical functions. The proposed algorithm is examined in a large collection of different structures and classes of optimization problems. Additionally, comparisons are made with two enhanced, up-to-date versions of the Nelder-Mead algorithm. The numerical results show that Hassan Nelder Mead is stable due to non-dependence on the number of parameters processed. It also performs a higher accuracy for high dimensions compared with the other algorithms and a faster convergence rate toward global minima with respect to the number of simplex gradient estimates.

Dynamic Hassan Nelder Mead with Simplex Free Selectivity for Unconstrained Optimization

This article provides a new tool for examining the efficiency and robustness of derivative-free optimization algorithms based on high-dimensional normalized data profiles that test a variety of performance metrics. Unlike the traditional data profiles that examine a single dimension, the proposed data profiles require several dimensions in order to analyze the relative performance of different optimization solutions. To design a use case, we utilize five sequences (solvers) of trigonometric simplex designs that extract different features of non-isometric reflections, as an example to show how various metrics (dimensions) are essential to provide a comprehensive evaluation about a particular solver relative to others. In addition, each designed sequence can rotate the starting simplex through an angle to designate the direction of the simplex. This type of features extraction is applied to each sequence of the triangular simplexes to determine a global minimum for a mathematical problem. To allocate an optimal sequence of trigonometric simplex designs, a linear model is used with the proposed data profiles to examine the convergence rate of the five simplexes. Furthermore, we compare the proposed five simplexes to an optimized version of the Nelder–Mead algorithm known as the Genetic Nelder–Mead algorithm. The experimental results demonstrate that the proposed data profiles lead to a better examination of the reliability and robustness for the considered solvers from a more comprehensive perspective than the existing data profiles. Finally, the high-dimensional data profiles reveal that the proposed solvers outperform the genetic solvers for all accuracy tests.

Hassan Musafer

Papers

Features Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection

An Enhanced Design of Sparse Autoencoder for Latent Features Extraction Based on Trigonometric Simplexes for Network Intrusion Detection Systems

Efficient Network Intrusion Detection Using PCA-Based Dimensionality Reduction of Features

Dynamic Hassan Nelder Mead with Simplex Free Selectivity for Unconstrained Optimization

High-dimensional normalized data profiles for testing derivative-free optimization algorithms