Intrusions in computer networks have increased significantly in the last decade, due in part to a profitable underground cyber-crime economy and the availability of sophisticated tools for launching such intrusions. Researchers in industry and academia have been proposing methods and building systems for detecting and preventing such security breaches for more than four decades. Solutions proposed for dealing with network intrusions can be broadly classified as signature-based and anomaly-based. Signature-based intrusion detection systems look for patterns that match known attacks. On the other hand, anomaly-based intrusion detection systems develop a model for distinguishing legitimate users’ behavior from that of malicious users’ and hence are capable of detecting unknown attacks. One of the approaches used to classify legitimate and anomalous behavior is to use Machine Learning (ML) techniques. Several intrusion detection systems based on ML techniques have been proposed in the literature. In this paper, we present a comprehensive critical survey of ML-based intrusion detection approaches presented in the literature in the last ten years. This survey would serve as a supplement to other general surveys on intrusion detection as well as a reference to recent work done in the area for researchers working in ML-based intrusion detection systems. We also discuss some open issues that need to be addressed.

Intrusion detection based on Machine Learning techniques in computer networks

https://www.mdpi.com/2227-9032/10/6/1084/pdf?version=1655256422

Human Activity Recognition Based on Embedded Sensor Data Fusion for the Internet of Healthcare Things

In this study, an Intrusion Detection System (IDS) is designed based on Machine Learning classifiers, and its performance is evaluated for the set of attacks entailed in the UNSWNB15 dataset. UNSWNB15 dataset contains 2,540,226 realistic network data instances and 49 features. Most research uses a representative sample of this dataset with present training and testing subsets, which includes 257,673 records in total. The dataset was submitted to visual data analysis to discover potential reasons or flaws which likely challenge Machine Learning classifiers. Pre-processing strategies are necessary before this data can be used for data-driven prototype development for IDS because of the class representation imbalance with pattern counts and feature overlap. The method used for pre-processing is implemented by min-max scaling in the normalization phase, followed by applying Elastic Net and Sequential Feature Selection (SFS) algorithms. This work employed ensemble methods using three base classifiers, namely Balanced Bagging, XGBoost, and RF-HDDT, augmented to address the imbalance issue. Parameters of Balanced Bagging and XGBoost are tuned for the imbalanced data, and the Hellinger distance metric supplements random Forest to address the limitations of the default distance metric. Two new algorithms are proposed to address the class overlap issue in the dataset and applied during training. These two algorithms are leveraged to help improve the performance on the testing dataset by affecting the final classification decision made by three base classifiers as part of the ensemble classifier, which employs a majority vote combiner. The performance evaluation of the proposed method for binary and multi-category classification was evaluated using standard metrics, including those generated from the confusion matrix, and compared to other studies using the same dataset. The proposed design outperforms those reported in the literature by a significant margin for binary and multi-category classification cases. Keywords—Machine learning; ensemble method; intrusion detection system; UNSW-NB15 datasets

/pdf/anomaly-based-network-intrusion-detection-using-ensemble-23kp9co8.pdf

Anomaly-based Network Intrusion Detection using Ensemble Machine Learning Approach

This work exploits the concept of one-class classifier applied to the problem of anomaly detection in communication networks. The article presents the design of an innovative anomaly detection algorithm based on polynomial interpolation technique and statistical analysis. The innovative method is applied to datasets largely used in the scientific community for bench-marking such as KDD99, UNSW-NB15 and CSE-CIC-IDS-2018, and further evaluated with application to a novel available dataset EDGE-IIOTSET 2022. The paper also reports experimental results showing that the proposed methodology outperforms classic one-class classifiers, such as Extreme Learning Machine and Support Vector Machine models, and rule-based intrusion detection system like SNORT. With respect to binary classifiers, this work has the advantage of not requiring any a-priori knowledge about attacks and is based on the collection of only normal data traffic.

/pdf/design-and-testing-novel-one-class-classifier-based-on-1sknudf3.pdf

Design and Testing Novel One-Class Classifier Based on Polynomial Interpolation With Application to Networking Security

In recent years, machine learning (ML) algorithms have been approved effective in the intrusion detection. However, as the ML algorithms are mainly applied to evaluate the anomaly of the network, the detection accuracy for cyberattacks with multiple types cannot be fully guaranteed. The existing algorithms for network intrusion detection based on ML or feature selection are on the basis of spurious correlation between features and cyberattacks, causing several wrong classifications. In order to tackle the abovementioned problems, this research aimed to establish a novel network intrusion detection system (NIDS) based on causal ML. The proposed system started with the identification of noisy features by causal intervention, while only the features that had a causality with cyberattacks were preserved. Then, the ML algorithm was used to make a preliminary classification to select the most relevant types of cyberattacks. As a result, the unique labeled cyberattack could be detected by the counterfactual detection algorithm. In addition to a relatively stable accuracy, the complexity of cyberattack detection could also be effectively reduced, with a maximum reduction to 94% on the size of training features. Moreover, in case of the availability of several types of cyberattacks, the detection accuracy was significantly improved compared with the previous ML algorithms.

/pdf/improving-the-accuracy-of-network-intrusion-detection-with-3ks06rtwtp.pdf

Improving the Accuracy of Network Intrusion Detection with Causal Machine Learning

Networks are exposed to an increasing number of cyberattacks due to their vulnerabilities. So, cybersecurity strives to make networks as safe as possible, by introducing defense systems to detect any suspicious activities. However, firewalls and classical intrusion detection systems (IDSs) suffer from continuous updating of their defined databases to detect threats. The new directions of the IDSs aim to leverage the machine learning models to design more robust systems with higher detection rates and lower false alarm rates. This research presents a novel network IDS, which plays an important role in network security and faces the current cyberattacks on networks using the UNSW-NB15 dataset benchmark. Our proposed system is a dynamically scalable multiclass machine learning-based network IDS. It consists of several stages based on supervised machine learning. It starts with the Synthetic Minority Oversampling Technique (SMOTE) method to solve the imbalanced classes problem in the dataset and then selects the important features for each class existing in the dataset by the Gini Impurity criterion using the Extremely Randomized Trees Classifier (Extra Trees Classifier). After that, a pretrained extreme learning machine (ELM) model is responsible for detecting the attacks separately, "One-Versus-All" as a binary classifier for each of them. Finally, the ELM classifier outputs become the inputs to a fully connected layer in order to learn from all their combinations, followed by a logistic regression layer to make soft decisions for all classes. Results show that our proposed system performs better than related works in terms of accuracy, false alarm rate, Receiver Operating Characteristic (ROC), and Precision-Recall Curves (PRCs).

/pdf/improving-the-performance-of-machine-learning-based-network-59q9t7b4st.pdf

Improving the Performance of Machine Learning-Based Network Intrusion Detection Systems on the UNSW-NB15 Dataset.

A survey of self-coordination in self-organizing network

Resource Allocation in OFDMA Femtocell Based LTE and 5G Networks with QoS Guarantees

Shadowed Rician model is considered to be the most appropriate that is used to characterize the impairments seen in wireless channels, which suffer Line-Of-Sight LOS shadowing and small-scale fading. In this model, the Probability Density Function PDF of the Signal to Noise Ratio SNR per symbol needs numerical solutions to be evaluated. More than that, for some values of the fading parameters, the numerical solution converging too slowly, and so needs too much time to be evaluated. This is considered as a problem in real time applications where delay is a critical issue. In this paper, the authors present and prove approximations for Shadowed Rician model according to the values of the fading parameters, which are the Rice factor and the Shadowing standard deviation. With the proposed approximation, the required PDF could be written in intervals which make it easier to calculate at parameters values that causes slow converging.

Approximating Shadowed Rician Model to Other Simpler Models

Unmanned Aerial Vehicle 'UAV' networking is evolving as a major state of the art research field,
thanks to the foreseen revolution in its applications. Enhancing the performance of such networks requires
developing a channel model between any couple of neighbors within the UAV network. In this paper, we
present a statistical signal reception model for the shadowed communication channel between two neighbors in
a UAV network. In this model, we consider both the shadowing effect and the small scale fading effect.
Focusing on the applications where a UAV network could be considered as a rural environment, the shadowing
is considered as a Line Of Sight (LOS) lognormal one, where the line-of-sight (LOS) component is shadowed
by obstacles present within the path between two network nodes. The presented model relates the power
spectral density of the received signal to noise ratio per symbol with the physical path parameters, which could
be measured in real time

/pdf/communication-channel-model-between-two-neighbors-in-uav-3gcz6n8zt6.pdf

Khaldoun Khorzom

Papers

Improving the Performance of Machine Learning-Based Network Intrusion Detection Systems on the UNSW-NB15 Dataset.

A survey of self-coordination in self-organizing network

Resource Allocation in OFDMA Femtocell Based LTE and 5G Networks with QoS Guarantees

Approximating Shadowed Rician Model to Other Simpler Models

Communication Channel Model Between Two Neighbors in UAV Networks