Adaptive anomaly‐based intrusion detection system using genetic algorithm and profiling

Resende, Paulo Angelo Alves; Drummond, André C.

doi:10.1002/spy2.36

Cited by 47 publications

(11 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Resende and Drummond [75] strongest features and weakest features were combined into a new feature N1 and N2, respectively. The features were trained with various Machine Learning classifiers with Principal Components Analysis.…”

Section: Network Intrusionmentioning

confidence: 99%

The impacts of artificial intelligence techniques in augmentation of cybersecurity: a comprehensive review

Naik

Mehta

Yagnik³

et al. 2021

Complex Intell. Syst.

View full text Add to dashboard Cite

Given the prevailing state of cybersecurity, it is reasonable to understand why cybersecurity experts are seriously considering artificial intelligence as a potential field that can aid improvements in conventional cybersecurity techniques. Various progressions in the field of technology have helped to mitigate some of the issues relating to cybersecurity. These advancements can be manifested by Big Data, Blockchain technology, Behavioral Analytics, to name but a few. The paper overviews the effects of applications of these technologies in cybersecurity. The central purpose of the paper is to review the application of AI techniques in analyzing, detecting, and fighting various cyberattacks. The effects of the implementation of conditionally classified “distributed” AI methods and conveniently classified “compact” AI methods on different cyber threats have been reviewed. Furthermore, the future scope and challenges of using such techniques in cybersecurity, are discussed. Finally, conclusions have been drawn in terms of evaluating the employment of different AI advancements in improving cybersecurity.

show abstract

Section: Network Intrusionmentioning

confidence: 99%

The impacts of artificial intelligence techniques in augmentation of cybersecurity: a comprehensive review

Naik

Mehta

Yagnik³

et al. 2021

Complex Intell. Syst.

View full text Add to dashboard Cite

show abstract

“…However, even if works that use the CICIDS2017 dataset exist, many of them are not specially designed to provide effective and efficient IDS systems against DoS attacks. Most of the research works conducted using this dataset are driven by other motivations which can be providing online detection [14], enhancing the performance of some ML classifiers [15][16][17], checking the efficiency of some feature selection algorithms, to provide anomaly detection [18], or meeting other objectives [11,13]. Some of them focus on providing an IDS system to detect all the attacks found in the datasets.…”

Section: Statement Of the Problem Even Ifmentioning

confidence: 99%

Efficient Intrusion Detection System for SDN Orchestrated Internet of Things

Zeleke

Melaku

Mengistu

2021

Journal of Computer Networks and Communications

View full text Add to dashboard Cite

Internet of Things (IoT) can simply be defined as an extension of the current Internet system. It extends the human to human interconnection and intercommunication scenario of the Internet by including things, to bring anytime, anywhere, and anything communication. A discipline in networking evolving in parallel with IoT is Software Defined Networking (SDN). It is an important technology that is aimed to solve the different problems existing in the traditional network systems. It provides a new convenient home to address the different challenges existing in different network-based systems including IoT. One important security challenge prevailing in such SDN-based IoT (SDIoT) systems is guarantying service availability. The ever-increasing denial of service (DoS) attacks are responsible for such service denials. A centralized signature-based intrusion detection system (IDS) is proposed and developed in this work. Random Forest (RF) classifier is used for training the model. A very popular and recent benchmark dataset, CICIDS2017, has been used for training and validating the machine learning (ML) models. An accuracy result of 99.968% has been achieved by using only 12 features on Wednesday’s release of the dataset. This result is higher than the achieved accuracy results of related works considering the original CICIDS2017 dataset. A maximum cross-validated accuracy result of 99.713% has been achieved on the same release of the dataset. These developed models meet the basic requirement of a supervised IDS system developed for smart environments and can effectively be used in different IoT service scenarios.

show abstract

“…We note that this dataset is commonly used in the evaluation of anomaly detection approaches with the learning stage performed on the first day [60], [61]. However, a few recent studies have considered these data also in the evaluation of classification approaches, as we do in this paper [36], [56], [62].…”

Section: A Dataset Descriptionmentioning

confidence: 99%

Multi-Channel Deep Feature Learning for Intrusion Detection

et al. 2020

View full text Add to dashboard Cite

Networks had an increasing impact on modern life since network cybersecurity has become an important research field. Several machine learning techniques have been developed to build network intrusion detection systems for correctly detecting unforeseen cyber-attacks at the network-level. For example, deep artificial neural network architectures have recently achieved state-of-the-art results. In this paper a novel deep neural network architecture is defined, in order to learn flexible and effective intrusion detection models, by combining an unsupervised stage for multi-channel feature learning with a supervised one exploiting feature dependencies on cross channels. The aim is to investigate whether class-specific features of the network flows could be learned and added to the original ones in order to increase the model accuracy. In particular, in the unsupervised stage, two autoencoders are separately learned on normal and attack flows, respectively. As the top layer in the decoder of these autoencoders reconstructs samples in the same space as the input one, they could be used to define two new feature vectors allowing the representation of each network flow as a multi-channel sample. In the supervised stage, a multi-channel parametric convolution is adopted, in order to learn the effect of each channel on the others. In particular, as the samples belong to two different distributions (normal and attack flows), the samples labelled as normal should be more similar to the representation reconstructed with the normal autoencoder than that of the attack one, and viceversa. This expected dependency will be exploited to better disentangle the differences between normal and attack flows. The proposed neural network architecture leads to better predictive accuracy when compared to competitive intrusion detection architectures on three benchmark datasets.

show abstract

Adaptive anomaly‐based intrusion detection system using genetic algorithm and profiling

Cited by 47 publications

References 36 publications

The impacts of artificial intelligence techniques in augmentation of cybersecurity: a comprehensive review

The impacts of artificial intelligence techniques in augmentation of cybersecurity: a comprehensive review

Efficient Intrusion Detection System for SDN Orchestrated Internet of Things

Multi-Channel Deep Feature Learning for Intrusion Detection

Contact Info

Product

Resources

About