STG2P: A two-stage pipeline model for intrusion detection based on improved LightGBM and K-means

Zhang, Zhiqiang; Wang, Le; Chen, Guangyao; Gu, Zhaoquan; Tian, Zhihong; Du, Xiaojiang; Guizani, Mohsen

doi:10.1016/j.simpat.2022.102614

Cited by 23 publications

(7 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To illustrate, let us pretend a binary classification model properly distinguishes between the negative and positive classifications. When the classification threshold is altered, the TPR ratio to the FPR is displayed graphically 38

$$ \mathrm{FPR}=\frac{\mathrm{FP}}{\mathrm{FP}+\mathrm{TN}}.

…”

Section: Resultsmentioning

confidence: 99%

OptimizedLightGBMmodel for security and privacy issues incyber‐physicalsystems

Dalal

Poongodi

Lilhore

et al. 2023

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Integrating physical, computational, and networking resources are the goal of cyber‐physical systems, also known as smart‐embedded systems. By investing in a solid foundation, we can improve the usefulness and timeliness of the services we rely on in every facet of our lives and ultimately live more elegantly. Regarding modern technology, data security is a significant factor that must be considered. The complexity of cyber‐physical systems' interacting components and middleware presents serious hurdles when it comes to protecting them from cyber‐attacks without negatively impacting their performance. This article proposes a unique, efficient encryption technique for anticipating cyber assaults in cyber‐physical systems, which addresses these concerns. The suggested method uses Bayesian optimization techniques to fine‐tune the LightGBM algorithm's hyper‐parameters. This proposed algorithm has been implemented on the intrusion detection dataset (UNR‐IDD) from the University of Nevada. Reno has been used to test the suggested approach. The proposed system achieved 99.17% accuracy, 0.9918 precision, and 0.9922 recall values. Our empirical evaluation demonstrates that the algorithm successfully increases accuracy and AUC value, making the cyber‐physical system more secure. In turn, the suggested methodology may offer robust assurance for user data safety.

show abstract

$$ \mathrm{FPR}=\frac{\mathrm{FP}}{\mathrm{FP}+\mathrm{TN}}.

…”

Section: Resultsmentioning

confidence: 99%

OptimizedLightGBMmodel for security and privacy issues incyber‐physicalsystems

Dalal

Poongodi

Lilhore

et al. 2023

Trans Emerging Tel Tech

View full text Add to dashboard Cite

show abstract

“…In the field of cyber security, intrusion detection has always been an important task that has attracted much attention [21][22][23]. There have been many important studies on dealing with imbalanced data.…”

Section: Related Workmentioning

confidence: 99%

Intrusion Detection Based on Adaptive Sample Distribution Dual-Experience Replay Reinforcement Learning

Tan,

Wang,

Zhu

et al. 2024

Mathematics

Self Cite

View full text Add to dashboard Cite

In order to cope with ever-evolving and increasing cyber threats, intrusion detection systems have become a crucial component of cyber security. Compared with signature-based intrusion detection methods, anomaly-based methods typically employ machine learning techniques to train detection models and possess the capability to discover unknown attacks. However, intrusion detection methods face the challenge of low detection rates for minority class attacks due to imbalanced data distributions. Traditional intrusion detection algorithms address this issue by resampling or generating synthetic data. Additionally, reinforcement learning, as a machine learning method that interacts with the environment to obtain feedback and improve performance, is gradually being considered for application in the field of intrusion detection. This paper proposes a reinforcement-learning-based intrusion detection method that innovatively uses adaptive sample distribution dual-experience replay to enhance a reinforcement learning algorithm, aiming to effectively address the issue of imbalanced sample distribution. We have also developed a reinforcement learning environment specifically designed for intrusion detection tasks. Experimental results demonstrate that the proposed model achieves favorable performance on the NSL-KDD, AWID, and CICIoT2023 datasets, effectively dealing with imbalanced data and showing better classification performance in detecting minority attacks.

show abstract

“…Compared with the above ensemble learning algorithm, the LightGBM has faster training speed and efficiency, so Zhang et al [11] built IDSSTG2P based on the LightGBM. They introduced a threshold in the LightGBM to increase its true positive rate and used it in the coarse classification stage, but also slightly increased the FAR.…”

Section: Related Workmentioning

confidence: 99%

Intrusion Detection Model of Internet of Things Based on LightGBM

Zhao

Wang

2023

IEICE Trans. Commun.

View full text Add to dashboard Cite

Internet of Things (IoT) devices are widely used in various fields. However, their limited computing resources make them extremely vulnerable and difficult to be effectively protected. Traditional intrusion detection systems (IDS) focus on high accuracy and low false alarm rate (FAR), making them often have too high spatiotemporal complexity to be deployed in IoT devices. In response to the above problems, this paper proposes an intrusion detection model of IoT based on the light gradient boosting machine (LightGBM). Firstly, the one-dimensional convolutional neural network (CNN) is used to extract features from network traffic to reduce the feature dimensions. Then, the LightGBM is used for classification to detect the type of network traffic belongs. The LightGBM is more lightweight on the basis of inheriting the advantages of the gradient boosting tree. The LightGBM has a faster decision tree construction process. Experiments on the TON-IoT and BoT-IoT datasets show that the proposed model has stronger performance and more lightweight than the comparison models. The proposed model can shorten the prediction time by 90.66% and is better than the comparison models in accuracy and other performance metrics. The proposed model has strong detection capability for denial of service (DoS) and distributed denial of service (DDoS) attacks. Experimental results on the testbed built with IoT devices such as Raspberry Pi show that the proposed model can perform effective and realtime intrusion detection on IoT devices.

show abstract

STG2P: A two-stage pipeline model for intrusion detection based on improved LightGBM and K-means

Cited by 23 publications

References 19 publications

OptimizedLightGBMmodel for security and privacy issues incyber‐physicalsystems

OptimizedLightGBMmodel for security and privacy issues incyber‐physicalsystems

Intrusion Detection Based on Adaptive Sample Distribution Dual-Experience Replay Reinforcement Learning

Intrusion Detection Model of Internet of Things Based on LightGBM

Contact Info

Product

Resources

About