Building a Cloud-IDS by Hybrid Bio-Inspired Feature Selection Algorithms Along With Random Forest Model

Abstract

The adoption of cloud computing has become increasingly widespread across various domains. However, the inherent security vulnerabilities of cloud computing pose significant risks to its overall safety. Consequently, intrusion detection systems (IDS) play a pivotal role in identifying malicious activities within a cloud system. The considerable volume of network traffic data may contain redundant and irrelevant features that can impact the classification performance of the classifier. In addition, the complexity and time consumption increase while processing such a substantial volume of data in the cloud intrusion detection process. To enhance the performance of the IDS, this study proposes a hybrid feature selection approach, combining two bio-inspired algorithms, namely the grasshopper optimization algorithm (GOA) and the genetic algorithm (GA). The combination of these two algorithms ensures a more efficient search for optimal solutions. A random forest (RF) classifier is trained using those optimal features. Moreover, the proposal addresses the challenge of imbalanced data by employing a hybrid approach: over-sampling the minority classes using an adaptive synthetic (ADASYN) algorithm, while implementing random under-sampling (RUS) for the majority class as needed. This integrated strategy significantly influences each category, enhancing the true positive rate (TPR) while minimizing the false positive rate (FPR), thus improving the overall system performance. The proposed approach was evaluated using three datasets: UNSW-NB15, CIC-DDoS2019, and CIC Bell DNS EXF 2021. The recorded accuracies for these datasets were 98%, 99%, and 92%, respectively. The hybrid feature selection-based IDS demonstrated superior performance in multi-class classification, along with exemplary results for individual classes within the datasets. The proposed strategy exhibited a marked superiority with the random forest classifier, especially when compared to other classifiers including SVM, LR, FLN, LSTM, AlexNet, DNN, DBN, DT, and XGBoost. Moreover, this performance remained consistent and commendable even when benchmarked against contemporary state-of-the-art methodologies across multiple evaluation metrics.

Cloud Network Anomaly Detection Using Machine and Deep Learning Techniques— Recent Research Advancements

“…The study [90] addressed cybersecurity, particularly focusing on constructing IDS tailored for cloud environments using bio-inspired feature selection algorithms in conjunction with a Random Forest (RF) model. The primary objectives were to develop a cloud-IDS utilizing hybrid bio-inspired feature selection algorithms alongside an RF model and to tackle the challenges associated with dataset development and feature selection in the realm of intrusion detection systems while showcasing enhanced performance and effectiveness compared to existing methodologies.…”

XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems

“…In addition, the landscape of intrusion detection in IoT and cloud computing is replete with diverse challenges and innovative solutions. The work presented in [29] discusses the deployment of bio-inspired algorithms for feature selection, significantly enhancing the predictive accuracy of the IDS; however, they highlight the inherent complexities and computational demands that these techniques introduce. The work in [76] surveys several XAI techniques, such as SHAP and LIME, and their applications and challenges in healthcare, such as the complexity of medical data and the critical need for accurate interpretations.…”

“…They emphasize the need for XAI to provide clarity on AI decisions, enhancing security measures against cyber threats. On the other hand, the works in [29,31,32] propose frameworks to enhance IDSs in the context of IoT and SCADA Systems. It is also worth mentioning [29,30,79], which do the same for network intrusion detection, leveraging ensemble learning and neural network applications.…”

“…On the other hand, the works in [29,31,32] propose frameworks to enhance IDSs in the context of IoT and SCADA Systems. It is also worth mentioning [29,30,79], which do the same for network intrusion detection, leveraging ensemble learning and neural network applications. The authors of [80] focused on identifying DNS over HTTPS (DoH), a protocol that encrypts DNS queries to enhance privacy but poses challenges for network administrators in detecting malicious activities.…”

“…These constraints highlight the urgent need to utilize the relatively new domain of explainable AI (XAI) to enhance the clarity of AI decisions in IDSs [28]. Moreover, other prior works have discussed the proliferation of network threats and cyber-attacks in recent years and emphasized the need for the development of sophisticated IDSs capable of not only detecting but also effectively mitigating such threats [29,30]. Additionally, the integration of deep learning techniques into IDSs has shown promising results in real-time anomaly detection for IoT and SCADA infrastructures [31,32].…”