Reduction the 10%KDD training dataset up to 99.8% by using modified K-means.New high quality training datasets are constructed for training SVM and ELM.Multi-level model is proposed to improve the performance of detection accuracy.Improve the detection rate of DoS, U2R and R2L attacks.Overall accuracy of 95.75% is achieved with whole Corrected KDD dataset. Intrusion detection has become essential to network security because of the increasing connectivity between computers. Several intrusion detection systems have been developed to protect networks using different statistical methods and machine learning techniques. This study aims to design a model that deals with real intrusion detection problems in data analysis and classify network data into normal and abnormal behaviors. This study proposes a multi-level hybrid intrusion detection model that uses support vector machine and extreme learning machine to improve the efficiency of detecting known and unknown attacks. A modified K-means algorithm is also proposed to build a high-quality training dataset that contributes significantly to improving the performance of classifiers. The modified K-means is used to build new small training datasets representing the entire original training dataset, significantly reduce the training time of classifiers, and improve the performance of intrusion detection system. The popular KDD Cup 1999 dataset is used to evaluate the proposed model. Compared with other methods based on the same dataset, the proposed model shows high efficiency in attack detection, and its accuracy (95.75%) is the best performance thus far.

Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system

Swarm intelligence in intrusion detection: A survey

Security is an important phenomena for energy conservation in wireless sensor networks (WSN). Moreover, the management of trust in the WSN is a challenging task since trust is used when collaboration is critical to achieve reliable communication. In a military application using WSN, it is often necessary to communicate secret information such as military operation urgently. However, the existing routing algorithms do not consider security in the routing process. Moreover, since security is an important aspect in WSN, it is necessary to consider the security aspects in routing algorithms. Different approaches for providing security are trust management, intrusion detection, firewalls and key management are considered in the literature. Among them, trust management can provide enhanced security when it is compared with other security methods. Therefore, a new secure routing algorithm called energy aware trust based secure routing algorithm is proposed in this paper where the trust score evaluation is used to detect the malicious users effectively in WSN and spatio-temporal constraints are used with decision tree algorithm for selecting the best route. From the experiments conducted, it is proved that the proposed trust based routing algorithm achieves significant performance improvement over the existing schemes in terms of security, energy efficiency and packet delivery ratio.

An Energy Aware Trust Based Secure Routing Algorithm for Effective Communication in Wireless Sensor Networks

The growth of data and categories of attacks, demand the use of Intrusion Detection System(IDS) effectively using Machine Learning(ML) and Deep Learning(DL) techniques. Apart from the ML and DL techniques, Swarm and Evolutionary (SWEVO) Algorithms have also shown significant performance to improve the efficiency of the IDS models. This survey covers SWEVO-based IDS approaches such as Genetic Algorithm(GA), Ant Colony Optimization(ACO), Particle Swarm Optimization(PSO), Artificial Bee Colony Optimization(ABC), Firefly Algorithm(FA), Bat Algorithm(BA), and Flower Pollination Algorithm(FPA). The paper also discusses applications of the SWEVO in the field of IDS along with challenges and possible future directions.

Role of swarm and evolutionary algorithms for intrusion detection system: A survey

Intrusion detection system (IDS) can effectively identify anomaly behaviors in the network; however, it still has low detection rate and high false alarm rate especially for anomalies with fewer records. In this paper, we propose an effective IDS by using hybrid data optimization which consists of two parts: data sampling and feature selection, called DO_IDS. In data sampling, the Isolation Forest (iForest) is used to eliminate outliers, genetic algorithm (GA) to optimize the sampling ratio, and the Random Forest (RF) classifier as the evaluation criteria to obtain the optimal training dataset. In feature selection, GA and RF are used again to obtain the optimal feature subset. Finally, an intrusion detection system based on RF is built using the optimal training dataset obtained by data sampling and the features selected by feature selection. The experiment will be carried out on the UNSW-NB15 dataset. Compared with other algorithms, the model has obvious advantages in detecting rare anomaly behaviors.

/pdf/building-an-effective-intrusion-detection-system-by-using-3cjwiuepea.pdf

Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

In mobile ad hoc networks the nodes are dynamically changing and they have a fully decentralized topology. Hence, security is hard to achieve due to the dynamic nature of the relationships between the participating nodes as well as the vulnerabilities and limitations of the wireless transmissions medium. In this paper we propose an enhancement on intrusion detection systems for ad hoc networks (EIDAN) based on a novel architecture that uses intrusion detection techniques to detect active attacks that an adversary can perform against routing fabric of mobile ad hoc networks. Moreover, the system has been designed to take countermeasures to attacks. The novelties of the system enable the detection of active attacks. The enhancement of intrusion detection system for ad hoc network (EIDAN) system does not introduce any changes to the underlying routing protocol and operates as an intermediate component between the network traffic and the routing protocol. The system was developed and tested to operate in ad hoc on demand distance vector routing (AODV) enabled networks using the network simulator (ns-2). This system has been designed to detect resource consumption attack, packet-dropping attack and fabrication attacks.

Enhanced intrusion detection techniques for mobile ad hoc networks

Intrusion Detection System (IDS) has recently emerged as an important component for enhancing information system security. However, constructing and maintaining a misuse intrusion detection system for a network is labor ? intensive, since attack scenarios and patterns need to be analyzed and categorized. Moreover, the rules corresponding to the scenarios and patterns need to be carefully hand-coded. In such situations, data mining can be used to ease this inconvenience. This paper proposes a multiple level hybrid classifier for an intrusion detection system that uses a combination of tree classifiers which uses Enhanced C4.5 which rely on labeled training data and an Enhanced Fast Heuristic Clustering Algorithm for mixed data (EFHCAM). The main advantage of this approach is that the system can be trained with unlabelled data and is capable of detecting previously "unseen" attacks. Verification tests have been carried out by using the 1999 KDD Cup data set. From this work, it is observed that significant improvement has been achieved from the viewpoint of both high intrusion detection rate and reasonably low false alarm rate.

An Intrusion Detection System Based on Multiple Level Hybrid Classifier using Enhanced C4.5

Intrusion detection systems are increasingly a key part of systems defense Various approaches to intrusion detection are currently being used, but they are relatively ineffective Constructing and maintaining a misuse detection system is very labor-intensive since attack scenarios and patterns need to be analyzed and categorized, and the corresponding rules and patterns need to be carefully hand-coded Thus data mining can be used to ease this inconvenience This paper proposes a multiple level hybrid classifier for an intrusion detection system that uses a combination of tree classifiers which rely on labeled training data and applies an Ant colony clustering algorithm for mixed data The main advantage of this approach is that the system can be trained with unlabelled data and is capable of detecting previously "unseen" attacks Verification tests have been carried out by using the 1999 KDD Cup data set From this work, it is observed that significant improvement has been achieved from the viewpoint of both high intrusion detection rate and reasonably low false alarm rate

L. Prema Rajeswari

Papers

Enhanced intrusion detection techniques for mobile ad hoc networks

An Intrusion Detection System Based on Multiple Level Hybrid Classifier using Enhanced C4.5

An escalated approach to ant colony clustering algorithm for intrusion detection system