A systematic literature review of methods and datasets for anomaly-based network intrusion detection

Yang, Zhen; Liu, Xiaodong; Li, Tong; Wu, Di; Wang, Jinjiang; Zhao, Yiru; Han, Han

doi:10.1016/j.cose.2022.102675

Cited by 138 publications

(48 citation statements)

References 78 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, many approaches have been proposed, exploring different techniques for different types of IDS (Phadke, Kulkarni, Bhawalkar, & Bhattad, 2019;Lansky et al, 2021). In DTS particular, anomaly-based network intrusion detection emerged as an important research and development direction of intrusion detection (Bhuyan et al, 2013;Yang et al, 2022). We also observed the emergence of specialized IDS in domains such as IoT (Tiwari & Narain, 2021), smart phones (Ahmad, Shah, & Al-Khasawneh, 2021), vehicles (Badukale, Thorat, & Rojatkar, 2021) and smart grids (Liu, Hagenmeyer, & Keller, 2021) just to mention a few.…”

Section: Related Workmentioning

confidence: 72%

See 1 more Smart Citation

Enabling intrusion detection systems with dueling double deep Q-learning

Badr

2022

DTS

View full text Add to dashboard Cite

PurposeIn this research, the authors demonstrate the advantage of reinforcement learning (RL) based intrusion detection systems (IDS) to solve very complex problems (e.g. selecting input features, considering scarce resources and constrains) that cannot be solved by classical machine learning. The authors include a comparative study to build intrusion detection based on statistical machine learning and representational learning, using knowledge discovery in databases (KDD) Cup99 and Installation Support Center of Expertise (ISCX) 2012.Design/methodology/approachThe methodology applies a data analytics approach, consisting of data exploration and machine learning model training and evaluation. To build a network-based intrusion detection system, the authors apply dueling double deep Q-networks architecture enabled with costly features, k-nearest neighbors (K-NN), support-vector machines (SVM) and convolution neural networks (CNN).FindingsMachine learning-based intrusion detection are trained on historical datasets which lead to model drift and lack of generalization whereas RL is trained with data collected through interactions. RL is bound to learn from its interactions with a stochastic environment in the absence of a training dataset whereas supervised learning simply learns from collected data and require less computational resources.Research limitations/implicationsAll machine learning models have achieved high accuracy values and performance. One potential reason is that both datasets are simulated, and not realistic. It was not clear whether a validation was ever performed to show that data were collected from real network traffics.Practical implicationsThe study provides guidelines to implement IDS with classical supervised learning, deep learning and RL.Originality/valueThe research applied the dueling double deep Q-networks architecture enabled with costly features to build network-based intrusion detection from network traffics. This research presents a comparative study of reinforcement-based instruction detection with counterparts built with statistical and representational machine learning.

show abstract

Section: Related Workmentioning

confidence: 72%

“…In particular, anomaly-based network intrusion detection emerged as an important research and development direction of intrusion detection (Bhuyan et al. , 2013; Yang et al. , 2022).…”

Section: Related Workmentioning

confidence: 99%

Enabling intrusion detection systems with dueling double deep Q-learning

Badr

2022

DTS

View full text Add to dashboard Cite

show abstract

“…More than 80 traffic scenarios are embedded in this dataset. [58]. In our proposed work, we have included all features of the CICIDS2018 dataset and its classes details along with instances are inducted in Table 3.…”

Section: Dataset Descriptionmentioning

confidence: 99%

Cyber Threats Detection in Smart Environments Using SDN-Enabled DNN-LSTM Hybrid Framework

et al. 2022

View full text Add to dashboard Cite

Internet of Things (IoT) is an instantly exacerbated communication technology that is manifesting miraculous effectuation to revolutionize conventional means of network communication. The applications of IoT are compendiously encompassing our prevalent lifestyle and the integration of IoT with other technologies makes this application spectrum even more latitudinous. However, this admissibility also introduces IoT with a pervasive array of imperative security hazards that demands noteworthy solutions to be swamped. In this scientific study, we proposed Deep Learning (DL) driven Software Defined Networking (SDN) enabled Intrusion Detection System (IDS) to combat emerging cyber threats in IoT. Our proposed model (DNNLSTM) is capable to encounter a tremendous class of common as well as less frequently occurring cyber threats in IoT communications. The proposed model is trained on CICIDS 2018 dataset, and its performance is evaluated on several decisive parameters i.e Accuracy, Precision, Recall, and F1-Score. Furthermore, the designed framework is analytically compared with relevant classifiers, i.e., DNNGRU, and BLSTM for appropriate validation. An exhaustive performance comparison is also conducted between the proposed system and a few preeminent solutions from the literature. The proposed design has circumvented the existing literature with unprecedented performance repercussions such as 99.55% accuracy, 99.36% precision, 99.44% recall, and 99.42% F1-score.

show abstract

“…Intrusion detection methods are mainly divided into misuse-based and anomalybased intrusion detection methods [4]. Misuse-based intrusion detection methods detect attack traffic in ICS by comparing the feature of detected traffic with the known attack traffic of historical traffic.…”

Section: Introductionmentioning

confidence: 99%

An Intrusion Detection Method for Industrial Control System Based on Machine Learning

et al. 2022

View full text Add to dashboard Cite

The integration of communication networks and the internet of industrial control in Industrial Control System (ICS) increases their vulnerability to cyber attacks, causing devastating outcomes. Traditional Intrusion Detection Systems (IDS) largely rely on predefined models and are trained mostly on specific cyber attacks, which means the traditional IDS cannot cope with unknown attacks. Additionally, most IDS do not consider the imbalanced nature of ICS datasets, thus suffering from low accuracy and high False Positive Rates when being put to use. In this paper, we propose the NCO–double-layer DIFF_RF–OPFYTHON intrusion detection method for ICS, which consists of NCO modules, double-layer DIFF_RF modules, and OPFYTHON modules. Detected traffic will be divided into three categories by the double-layer DIFF_RF module: known attacks, unknown attacks, and normal traffic. Then, the known attacks will be classified into specific attacks by the OPFYTHON module according to the feature of attack traffic. Finally, we use the NCO module to improve the model input and enhance the accuracy of the model. The results show that the proposed method outperforms traditional intrusion detection methods, such as XGboost and SVM. The detection of unknown attacks is also considerable. The accuracy of the dataset used in this paper reaches 98.13%. The detection rates for unknown attacks and known attacks reach 98.21% and 95.1%, respectively. Moreover, the method we proposed has achieved suitable results on other public datasets.

show abstract

A systematic literature review of methods and datasets for anomaly-based network intrusion detection

Cited by 138 publications

References 78 publications

Enabling intrusion detection systems with dueling double deep Q-learning

Enabling intrusion detection systems with dueling double deep Q-learning

Cyber Threats Detection in Smart Environments Using SDN-Enabled DNN-LSTM Hybrid Framework

An Intrusion Detection Method for Industrial Control System Based on Machine Learning

Contact Info

Product

Resources

About