Ensemble Learning for Threat Classification in Network Intrusion Detection on a Security Monitoring System for Renewable Energy

Lin, Hsiao-Chung; Wang, Ping; Chao, Kuo-Ming; Lin, Wen-Hui; Yang, Zhe

doi:10.3390/app112311283

Cited by 9 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the literature, several studies show that resampling unbalanced datasets generates more robust classification systems. In Lin et al (2021) , a classifier based on Random Forest ensemble is proposed for intrusion detection to a renewable energy system. This research applies SMOTE-based oversampling techniques to resample the classes and minimize the classification error.…”

Section: Related Workmentioning

confidence: 99%

A detailed study of resampling algorithms for cyberattack classification in engineering applications

Mogollón Gutiérrez,

Sancho Núñez,

Ávila

et al. 2024

PeerJ Computer Science

View full text Add to dashboard Cite

The evolution of engineering applications is highly relevant in the context of protecting industrial systems. As industries are increasingly interconnected, the need for robust cybersecurity measures becomes paramount. Engineering informatics not only provides tools for knowledge representation and extraction but also affords a comprehensive spectrum of developing sophisticated cybersecurity solutions. However, safeguarding industrial systems poses a unique challenge due to the inherent heterogeneity of data within these environments. Together with this problem, it’s crucial to acknowledge that datasets that simulate real cyberattacks within these diverse environments exhibit a high imbalance, often skewed towards certain types of traffics. This study proposes a system for addressing class imbalance in cybersecurity. To do this, three oversampling (SMOTE, Borderline1-SMOTE, and ADASYN) and five undersampling (random undersampling, cluster centroids, NearMiss, repeated edited nearest neighbor, and Tomek Links) methods are tested. Particularly, these balancing algorithms are used to generate one-vs-rest binary models and to develop a two-stage classification system. By doing so, this study aims to enhance the efficacy of cybersecurity measures ensuring a more comprehensive understanding and defense against the diverse range of threats encountered in industrial environments. Experimental results demonstrates the effectiveness of proposed system for cyberattack detection and classification among nine widely known cyberattacks.

show abstract

Section: Related Workmentioning

confidence: 99%

A detailed study of resampling algorithms for cyberattack classification in engineering applications

Mogollón Gutiérrez,

Sancho Núñez,

Ávila

et al. 2024

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…Most previous studies [2,3,[7][8][9] on intrusion detection in in-vehicle networks focus on detecting abnormal CAN messages using a base classifier such as DT, LR, SVC, CNN, or LSTM, as shown in Figure 3. Feature selection is the process of reducing the number of input variables to develop a predictive model using a selected feature set to improve the performance of the model by reducing the computational costs of modelling [37]. (ii) hyperparameter tuning.…”

Section: Xgboost Classifiermentioning

confidence: 99%

“…In the training process, there are important topics for the ML model: (i) feature selection. Feature selection is the process of reducing the number of input variables to develop a predictive model using a selected feature set to improve the performance of the model by reducing the computational costs of modelling [37]. (ii) hyperparameter tuning.…”

Section: Xgboost Classifiermentioning

confidence: 99%

“…As shown in Figure 3, a base (individual) classifier in ML models use the selected feature vectors from the training instances to train the model, determine the hyperparameters of the trained model, and predict the possible categories of test data. In the training process, there are important topics for the ML model: (i) feature selection.Feature selection is the process of reducing the number of input variables to develop a predictive model using a selected feature set to improve the performance of the model by reducing the computational costs of modelling[37]. (ii) hyperparameter tuning.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

et al. 2022

Self Cite

View full text Add to dashboard Cite

With rapid advancements in in-vehicle network (IVN) technology, the demand for multiple advanced functions and networking in electric vehicles (EVs) has recently increased. To enable various intelligent functions, the electrical system of existing vehicles incorporates a controller area network (CAN) bus system that enables communication among electrical control units (ECUs). In practice, traditional network-based intrusion detection systems (NIDSs) cannot easily identify threats to the CAN bus system. Therefore, it is necessary to develop a new type of NIDS—namely, on-the-move Intrusion Detection System (OMIDS)—to categorise these threats. Accordingly, this paper proposes an intrusion detection model for IVNs, based on the VGG16 classifier deep learning model, to learn attack behaviour characteristics and classify threats. The experimental dataset was provided by the Hacking and Countermeasure Research Lab (HCRL) to validate classification performance for denial of service (DoS), fuzzy attacks, spoofing gear, and RPM in vehicle communications. The proposed classifier’s performance was compared with that of the XBoost ensemble learning scheme to identify threats from in-vehicle networks. In particular, the test cases can detect anomalies in terms of accuracy, precision, recall, and F1-score to ensure detection accuracy and identify false alarm threats. The experimental results show that the classification accuracy of the dataset for HCRL Car-Hacking by the VGG16 and XBoost classifiers (n = 50) reached 97.8241% and 99.9995% for the 5-subcategory classification results on the testing data, respectively.

show abstract

“…In [15], an EL scheme based on an RF model is proposed. To decrease classification error, the SMOTE was proposed.…”

Section: Introductionmentioning

confidence: 99%

Empowering Cybersecurity Using Enhanced Rat Swarm Optimization With Deep Stack-Based Ensemble Learning Approach

Manickam,

Girija,

Kumar Dutta

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Cybersecurity is a vital technology and measures intended to protect networks, computers, information, and programs from threats and illegal access, modification, or damage. A security model covers a network and a computer safety method. Each system has antivirus software, firewalls, and an intrusion detection system (IDS). IDS helps in discovering and identifying illegal system behavior such as usage, copying, alteration, and damage. By estimating network traffic anomalies and patterns, deep learning (DL) models can enhance the detection abilities of IDS when compared to traditional rule-based methods. These models learn complex representations from data, authorizing them to recognize subtle and developing attack patterns. Techniques like recurrent neural network (RNN) and convolutional neural network (CNN) can be applied to progress consecutive or spatial features in network data, correspondingly. This manuscript empowers Cybersecurity by utilizing an Enhanced Rat Swarm Optimizer with a Deep Stack-Based Ensemble Learning (ERSO-DSEL) model. The ERSO-DSEL approach leverages feature selection (FS) with EL strategies to boost cybersecurity. In the ERSO-DSEL system, Z-score normalization is employed to measure the input data. Besides, an improved equilibrium optimizer (IEO) based FS approach is applied to choose a set of features. For cyberattack recognition, the ERSO-DSBEL approach uses the DSEL approach comprising three models namely deep neural network (DNN), long short-term memory (LSTM), and bidirectional LSTM (Bi-LSTM). Furthermore, the hyperparameter selection of these DL models takes place using the ERSO system. The solution result of the ERSO-DSBEL model is executed on a benchmark IDS database. A widecontrast study reported that the ERSO-DSBEL model accomplishes an enhanced accuracy outcome of 99.67% over other models of cybersecurity.

show abstract

Ensemble Learning for Threat Classification in Network Intrusion Detection on a Security Monitoring System for Renewable Energy

Cited by 9 publications

References 19 publications

A detailed study of resampling algorithms for cyberattack classification in engineering applications

A detailed study of resampling algorithms for cyberattack classification in engineering applications

Using Deep Learning Networks to Identify Cyber Attacks on Intrusion Detection for In-Vehicle Networks

Empowering Cybersecurity Using Enhanced Rat Swarm Optimization With Deep Stack-Based Ensemble Learning Approach

Contact Info

Product

Resources

About