A Novel Framework Design of Network Intrusion Detection Based on Machine Learning Techniques

Zhang, Chongzhen; Chen, Yanli; Yang, Meng; Ruan, Fangming; Chen, Runze; Yidan, Li; Yang, Yaru

doi:10.1155/2021/6610675

Cited by 23 publications

(11 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…By detecting CPU occupancy in real time and finding appropriate dynamic parameters, the recognition time of CNN model was reduced, and a new framework of online traffic detection technology was realized. Chongzhen Zhang et al [36] proposed a general intrusion detection framework that used an unsupervised autoencoder for feature extraction, and the extracted low-dimensional recombined features were stored for testing and retraining. However, the results showed that the recognition rate of small samples was lower than other sample categories in multi-classification.…”

Section: Related Workmentioning

confidence: 99%

RICNN: A ResNet&Inception convolutional neural network for intrusion detection of abnormal traffic

2022

View full text Add to dashboard Cite

To secure cloud computing and outsourced data while meeting the requirements of automation, many intrusion detection schemes based on deep learn ing are proposed. Though the detection rate of many network intrusion detection solutions can be quite high nowadays, their identification accuracy on imbalanced abnormal network traffic still remains low. Therefore, this paper proposes a ResNet &Inception-based convolutional neural network (RICNN) model to abnormal traffic classification. RICNN can learn more traffic features through the Inception unit, and the degradation problem of the network is eliminated through the direct map ping unit of ResNet, thus the improvement of the model?s generalization ability can be achievable. In addition, to simplify the network, an improved version of RICNN, which makes it possible to reduce the number of parameters that need to be learnt without degrading identification accuracy, is also proposed in this paper. The experimental results on the dataset CICIDS2017 show that RICNN not only achieves an overall accuracy of 99.386% but also has a high detection rate across different categories, especially for small samples. The comparison experiments show that the recognition rate of RICNN outperforms a variety of CNN models and RNN models, and the best detection accuracy can be achieved.

show abstract

Section: Related Workmentioning

confidence: 99%

RICNN: A ResNet&Inception convolutional neural network for intrusion detection of abnormal traffic

2022

View full text Add to dashboard Cite

show abstract

“…[75]. Researchers have explored a great deal in the possibility of robust NBM-based IDS development using ML, and DL approaches in the last decade [63], [76]- [81]. On the downside, NBM-based IDS would only track that traffic going through a particular network sector.…”

Section: Ids Taxonomymentioning

confidence: 99%

Intrusion Detection System in Software-Defined Networks Using Machine Learning and Deep Learning Techniques –A Comprehensive Survey

Rayhan¹,

Islam²,

Shatabda³

et al. 2022

Preprint

View full text Add to dashboard Cite

<div>At present, the Internet is facing numerous attacks of different kinds that put its data at risk. The safety of information within the network is, therefore, a significant concern. In order to prevent the loss of incredibly valuable information, the Intrusion Detection System (IDS) was developed to recognize the outbreak of a stream of attacks and notify the network system administrator providing network security. IDS is an extrapolative model used to detect network traffic as routine or attack. Software-Defined Networks (SDN) is a revolutionary paradigm that isolates the control plane from the data plane, transforming the concept of a software-driven network. Through this data and control plane separation, SDN provides us the opportunity to create a manageable and programmable network, allowing applications in the top plane to access physical devices via the controller. The controller functioning inside the control plane executes network modules and establishes flow rules to forward packets in the switches residing in the data plane. Cyber attackers target the SDN controller to subdue the control plane, which is considered the brain of the SDN, providing a plethora of functionalities such as regulating flow control to switches or routers in the data plane below via southbound Application Programming Interfaces (APIs) and business and application logic in the application plane above via northbound APIs to implement sophisticated networks. However, the control plane becomes a tempting prospect for security attacks from adversaries because of its centralization feature. This paper includes an in-depth overview of the notable published articles from 2015 to 2021 that used Machine Learning (ML) and Deep Learning (DL) techniques to construct an IDS solution to provide security for SDN. We also present two detailed taxonomic studies regarding IDS, and ML-DL techniques based on their learning categories, exploring various IDS solutions to secure the SDN paradigm. We have also conducted brief research on a few benchmark datasets used to construct IDS in the SDN paradigm. To conclude the survey, we provide a discussion that sheds light on continuous challenges and IDS issues for SDN security.</div>

show abstract

“…A literature work has been carried out to examine recent findings in the area of IDS solutions in MEC networks [66][67][68][69][70][71][72][73][74]. A firewall architecture has been designed to protect the edge network from the insider attack [75].…”

Section: Related Workmentioning

confidence: 99%

An edge based hybrid intrusion detection framework for mobile edge computing

Singh

Chatterjee

Satapathy

2021

Complex Intell. Syst.

View full text Add to dashboard Cite

The Mobile Edge Computing (MEC) model attracts more users to its services due to its characteristics and rapid delivery approach. This network architecture capability enables users to access the information from the edge of the network. But, the security of this edge network architecture is a big challenge. All the MEC services are available in a shared manner and accessed by users via the Internet. Attacks like the user to root, remote login, Denial of Service (DoS), snooping, port scanning, etc., can be possible in this computing environment due to Internet-based remote service. Intrusion detection is an approach to protect the network by detecting attacks. Existing detection models can detect only the known attacks and the efficiency for monitoring the real-time network traffic is low. The existing intrusion detection solutions cannot identify new unknown attacks. Hence, there is a need of an Edge-based Hybrid Intrusion Detection Framework (EHIDF) that not only detects known attacks but also capable of detecting unknown attacks in real time with low False Alarm Rate (FAR). This paper aims to propose an EHIDF which is mainly considered the Machine Learning (ML) approach for detecting intrusive traffics in the MEC environment. The proposed framework consists of three intrusion detection modules with three different classifiers. The Signature Detection Module (SDM) uses a C4.5 classifier, Anomaly Detection Module (ADM) uses Naive-based classifier, and Hybrid Detection Module (HDM) uses the Meta-AdaboostM1 algorithm. The developed EHIDF can solve the present detection problems by detecting new unknown attacks with low FAR. The implementation results illustrate that EHIDF accuracy is 90.25% and FAR is 1.1%. These results are compared with previous works and found improved performance. The accuracy is improved up to 10.78% and FAR is reduced up to 93%. A game-theoretical approach is also discussed to analyze the security strength of the proposed framework.

show abstract

A Novel Framework Design of Network Intrusion Detection Based on Machine Learning Techniques

Cited by 23 publications

References 22 publications

RICNN: A ResNet&Inception convolutional neural network for intrusion detection of abnormal traffic

RICNN: A ResNet&Inception convolutional neural network for intrusion detection of abnormal traffic

Intrusion Detection System in Software-Defined Networks Using Machine Learning and Deep Learning Techniques –A Comprehensive Survey

An edge based hybrid intrusion detection framework for mobile edge computing

Contact Info

Product

Resources

About