Data-driven methods have been widely used in network intrusion detection (NID) systems. However, there are currently a number of challenges derived from how the datasets are being collected. Most attack classes in network intrusion datasets are considered the minority compared to normal traffic and many datasets are collected through virtual machines or other simulated environments rather than real-world networks. These challenges undermine the performance of intrusion detection machine learning models by fitting models such as random forests or support vector machines to unrepresentative "sandbox" datasets. This survey presents a carefully designed taxonomy highlighting eight main challenges and solutions and explores common datasets from 1999 to 2020. Trends are analyzed on the distribution of challenges addressed for the past decade and future directions are proposed on expanding NID into cloud-based environments, devising scalable models for larger amount of network intrusion data, and creating labeled datasets collected in real-world networks.
With the increasing number of network threats it is essential to have a knowledge of existing and new network threats in order to design better intrusion detection systems. In this paper we propose a taxonomy for classifying network attacks in a consistent way, allowing security researchers to focus their efforts on creating accurate intrusion detection systems and targeted datasets.
Abertay University（阿伯泰大学）；Naval Academy Research Institute（海军学院研究院）；Middlesex University（密德萨斯大学）；University of Strathclyde（思克莱德大学）
As the world moves towards being increasingly dependent on computers and automation, building secure applications, systems and networks are some of the main challenges faced in the current decade. The number of threats that individuals and businesses face is rising exponentially due to the increasing complexity of networks and services of modern networks. To alleviate the impact of these threats, researchers have proposed numerous solutions for anomaly detection; however, current tools often fail to adapt to ever-changing architectures, associated threats and zero-day attacks. This manuscript …
With the ubiquitous nature of information technology solutions that facilitate communication in the modern world, cyber attacks are increasing in volume and becoming more sophisticated in nature. From classic network-based Denial of Service (DoS) attacks to the more recent concerns of privacy compromises, Intrusion Detection Systems (IDS) are becoming an urgent need to safeguard the modern information technology landscape. The development of these IDS relies on training and evaluation datasets that must evolve with time and represent the contemporary threat landscape. The purpose of this analy…
Internet of Things (IoT) has brought along immense benefits to our daily lives encompassing a diverse range of application domains that we regularly interact with, ranging from healthcare automation to transport and smart environments. However, due to the limitation of constrained resources and computational capabilities, IoT networks are prone to various cyber attacks. Thus, defending the IoT network against adversarial attacks is of vital importance. In this paper, we present a novel intrusion detection approach for IoT networks through the application of a deep learning technique. We adopt …
AI-driven Intrusion Detection for UAV in Smart Urban Ecosystems: A Comprehensive Survey
College of Computer Science and Information Systems, Najran University（纳季兰大学计算机科学与信息系统学院）；Saudi Technology and Security Comprehensive Control Company (Tahakom)（沙特技术与安全综合控制公司（塔哈科姆））；National School of Artificial Intelligence (ENSIA)（国立人工智能学院）；Computer, Electrical, and Mathematical Sciences and Engineering (CEMSE) Division, King Abdullah University of Science and Technology (KAUST)（阿卜杜拉国王科技大学计算机、电气和数学科学与工程部）
Attackers have developed ever more sophisticated and intelligent ways to hack information and communication technology systems. The extent of damage an individual hacker can carry out upon infiltrating a system is well understood. A potentially catastrophic scenario can be envisaged where a nation-state intercepting encrypted financial data gets hacked. Thus, intelligent cybersecurity systems have become inevitably important for improved protection against malicious threats. However, as malware attacks continue to dramatically increase in volume and complexity, it has become ever more challeng…
With massive data being generated daily and the ever-increasing interconnectivity of the world's Internet infrastructures, a machine learning based intrusion detection system (IDS) has become a vital component to protect our economic and national security. In this paper, we perform a comprehensive study on NSL-KDD, a network traffic dataset, by visualizing patterns and employing different learning-based models to detect cyber attacks. Unlike previous shallow learning and deep learning models that use the single learning model approach for intrusion detection, we adopt a hierarchy strategy, in …
AI-Driven Chatbot for Intrusion Detection in Edge Networks: Enhancing Cybersecurity with Ethical User Consent
School of Computer Science, University of Galway（戈尔韦大学计算机科学学院）；Faculty of Information Technology and Computer Science, University of Central Punjab（旁遮普中央大学信息技术与计算机科学学院）
Machine Learning-Assisted Intrusion Detection for Enhancing Internet of Things Security
University of New Mexico（新墨西哥大学）；Florida International University（佛罗里达国际大学）；Florida Atlantic University（佛罗里达大西洋大学）；University of Washington（华盛顿大学）；Islamic Azad University（伊斯兰阿扎德大学）
Delft University of Technology（代尔夫特理工大学）；Rochester Institute of Technology（罗切斯特理工大学）
Attack graphs (AG) are used to assess pathways availed by cyber adversaries to penetrate a network. State-of-the-art approaches for AG generation focus mostly on deriving dependencies between system vulnerabilities based on network scans and expert knowledge. In real-world operations however, it is costly and ineffective to rely on constant vulnerability scanning and expert-crafted AGs. We propose to automatically learn AGs based on actions observed through intrusion alerts, without prior expert knowledge. Specifically, we develop an unsupervised sequence learning system, SAGE, that leverages …
Growing concern for individual privacy, driven by an increased public awareness of the degree to which many of our electronic activities are tracked by interested third parties (e.g. Google knows what I am thinking before I finish entering my search query), is driving the development anonymizing technologies (e.g. Tor). The coming mass migration to IPv6 as the primary transport of Internet traffic promises to make one such technology, end-to-end host based encryption, more readily available to the average user. In a world where end-to-end encryption is ubiquitous, what can replace the existing…
With the development of incipient technologies, user devices becoming more exposed and ill-used by foes. In upcoming decades, traditional security measures will not be sufficient enough to handle this huge threat towards distributed hardware and software. Lack of standard network attack taxonomy has become an indispensable dispute on developing a clear understanding about the attacks in order to have an operative protection mechanism. Present attack categorization techniques protect a specific group of threat which has either messed the entire taxonomy structure or ambiguous when one network a…
IT security community is recently facing a change of trend from closed to open working groups and from restrictive information to full information disclosure and sharing. One major feature for this trend change is the number of incidents and various Indicators of compromise (IoC) that appear on a daily base, which can only be faced and solved in a collaborative way. Sharing information is key to stay on top of the threats. To cover the needs of having a medium for information sharing, different initiatives were taken such as the Open Source Threat Intelligence and Sharing Platform called MISP.…
Modern vehicles rely on scores of electronic control units (ECUs) broadcasting messages over a few controller area networks (CANs). Bereft of security features, in-vehicle CANs are exposed to cyber manipulation and multiple researches have proved viable, life-threatening cyber attacks. Complicating the issue, CAN messages lack a common mapping of functions to commands, so packets are observable but not easily decipherable. We present a transformational approach to CAN IDS that exploits the geometric properties of CAN data to inform two novel detectors--one based on distance from a learned, low…
From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures
École de technologie supérieure (ÉTS)（高等技术学院（ÉTS））；University of Calgary（卡尔加里大学）
Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems
Computer and Information Science Department, Fordham University（福特汉姆大学计算机与信息科学系）；RENCI, University of North Carolina at Chapel Hill（北卡罗来纳大学教堂山分校RENCI）；Department of Mathematics and Computer Science, Royal Military College of Canada（加拿大皇家军事学院数学与计算机科学系）；Data Science Department, University of North Texas（德克萨斯大学纳夫卡特数据科学系）
With the growing cyber-security threats, ensuring the security of data in Cloud data centers is a challenging task. A prominent type of attack on Cloud data centers is data tampering attack that can jeopardize the confidentiality and the integrity of data. In this article, we present a security and performance driven architecture for these centers that incorporates an intrusion management system for multi-tenant distributed transactional databases. The proposed architecture uses a novel data partitioning and placement scheme based on damage containment and communication cost of distributed tra…
Large Language Models for Network Intrusion Detection Systems: Foundations, Implementations, and Future Directions
Department of Electrical and Electronic Engineering, The University of Hong Kong（香港大学电子与电气工程系）；Department of Electronic Engineering, Tsinghua University（清华大学电子工程系）；National Institute of Health Data Science, Peking University（北京大学健康数据科学国家研究院）；Data Science and Analytics Thrust, Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）数据科学与分析方向）
Policy-Driven AI in Dataspaces: Taxonomy, Explainability, and Pathways for Compliant Innovation
Department of CST Tsinghua University Beijing, China（计算机科学与技术系 清华大学 北京中国）；Department of CSE Chandigarh University Mohali, India（计算机科学与工程系 印度昌迪加尔大学 摩哈利）
