Our increasingly connected world continues to face an ever-growing amount of network-based attacks. Intrusion detection systems (IDS) are an essential security technology for detecting these attacks. Although numerous machine learning-based IDS have been proposed for the detection of malicious network traffic, the majority have difficulty properly detecting and classifying the more uncommon attack types. In this paper, we implement a novel hybrid technique using synthetic data produced by a Generative Adversarial Network (GAN) to use as input for training a Deep Reinforcement Learning (DRL) model. Our GAN model is trained with the NSL-KDD dataset for four attack categories as well as normal network flow. Ultimately, our findings demonstrate that training the DRL on specific synthetic datasets can result in better performance in correctly classifying minority classes over training on the true imbalanced dataset.
A Survey for Deep Reinforcement Learning Based Network Intrusion Detection
Department of Computer Sciences, University of Liverpool（计算机科学系，利物浦大学）；Centre for Doctoral Training (CDT) in Distributed Algorithm, University of Liverpool（分布式算法博士培训中心，利物浦大学）；Department of Electrical Engineering and Electronics, University of Liverpool（电子工程与电子系，利物浦大学）；Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（深圳先进技术研究所，中国科学院）
Polytechnic of Porto（波尔图理工学院）；School of Engineering, Polytechnic of Porto (ISEP/IPP)（波尔图理工学院工程学院（ISEP/IPP））；Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD)（高级创新与发展智能工程与计算研究组（GECAD））
The digital transformation faces tremendous security challenges. In particular, the growing number of cyber-attacks targeting Internet of Things (IoT) systems restates the need for a reliable detection of malicious network activity. This paper presents a comparative analysis of supervised, unsupervised and reinforcement learning techniques on nine malware captures of the IoT-23 dataset, considering both binary and multi-class classification scenarios. The developed models consisted of Support Vector Machine (SVM), Extreme Gradient Boosting (XGBoost), Light Gradient Boosting Machine (LightGBM),…
The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyber attacks more than ever. The complexity and dynamics of cyber attacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This paper presents a survey of DRL approaches develop…
In this paper, we propose a novel mechanism to normalize metamorphic and obfuscated malware down at the opcode level and hence create an advanced metamorphic malware de-obfuscation and defense system. We name this system DRLDO, for Deep Reinforcement Learning based De-Obfuscator. With the inclusion of the DRLDO as a sub-component, an existing Intrusion Detection System could be augmented with defensive capabilities against 'zero-day' attacks from obfuscated and metamorphic variants of existing malware. This gains importance, not only because there exists no system to date that uses advanced DR…
Enhanced Intrusion Detection System for Multiclass Classification in UAV Networks
College of computing, Mohammed VI Polytechnic University（计算学院，穆莱·易斯·本·阿卜杜勒拉赫曼技术大学）；Ibn Tofail University, Faculty of Sciences, Laboratory of Research in Informatics (LaRI)（伊本·托法尔大学，科学学院，信息研究实验室（LaRI））
University of Lahore（拉合尔大学）；NUCES（巴基斯坦国家计算机与新兴科学大学）
Network security has become the biggest concern in the area of cyber security because of the exponential growth in computer networks and applications. Intrusion detection plays an important role in the security of information systems or networks devices. The purpose of an intrusion detection system (IDS) is to detect malicious activities and then generate an alarm against these activities. Having a large amount of data is one of the key problems in detecting attacks. Most of the intrusion detection systems use all features of datasets to evaluate the models and result in is, low detection rate…
Due to an exponential increase in the number of cyber-attacks, the need for improved Intrusion Detection Systems (IDS) is apparent than ever. In this regard, Machine Learning (ML) techniques are playing a pivotal role in the early classification of the attacks in case of intrusion detection within the system. However, due to a large number of algorithms available, the selection of the right method is a challenging task. To resolve this issue, this paper analyses some of the current state-of-the-art intrusion detection methods and discusses their pros and cons. Further, a review of different ML…
Machine Learning-Based Intrusion Detection: Feature Selection versus Feature Extraction
MobiFone Research and Development Center, MobiFone Corporation（MobiFone公司MobiFone研发中心）；Hanoi University of Science and Technology（河内科技大学）；Phenikaa University（菲尼卡大学）
A Novel Unified Lightweight Temporal-Spatial Transformer Approach for Intrusion Detection in Drone Networks
Department of Computer Science and Engineering, Jahangirnagar University（贾杭吉纳大学计算机科学与工程系）；Department of Computer Science and Engineering, Bangladesh Army University of Science & Technology（孟加拉国陆军科学技术大学计算机科学与工程系）；State University of Bangladesh, Department of Computer Science and Engineering（孟加拉国国立大学计算机科学与工程系）；Skill Morph Research Lab., Skill Morph（Skill Morph研究实验室）
Supervisory Control and Data Acquisition (SCADA) systems face the absence of a protection technique that can beat different types of intrusions and protect the data from disclosure while handling this data using other applications, specifically Intrusion Detection System (IDS). The SCADA system can manage the critical infrastructure of industrial control environments. Protecting sensitive information is a difficult task to achieve in reality with the connection of physical and digital systems. Hence, privacy preservation techniques have become effective in order to protect sensitive/private in…
Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN
Department of Control Science & Engineering, Tongji University（同济大学控制科学与工程系）；National Key Laboratory of Autonomous Intelligent Unmanned Systems（国家自主智能无人系统重点实验室）
University of Murcia（穆尔西亚大学）；European Commission, Joint Research Centre（欧盟委员会联合研究中心）
The application of Machine Learning (ML) techniques to the well-known intrusion detection systems (IDS) is key to cope with increasingly sophisticated cybersecurity attacks through an effective and efficient detection process. In the context of the Internet of Things (IoT), most ML-enabled IDS approaches use centralized approaches where IoT devices share their data with data centers for further analysis. To mitigate privacy concerns associated with centralized approaches, in recent years the use of Federated Learning (FL) has attracted a significant interest in different sectors, including hea…
The rapid growth of technology has led to the creation of computing networks. The applications of the Internet of Things are becoming more and more visible with the expansion and development of sensors and the use of a series of equipment to connect to the Internet. Of course, the growth of any network will also provide some challenges. The main challenge of IoT like any other network is its security. In the field of security, there are issues such as attack detection, authentication, encryption and the so on. One of the most important attack is cyber-attacks that disrupt the network usage. On…
AutoDP-LLM: Automating Data Pre-processing for Intrusion Detection Systems using Large Language Models
National Economics University（国民经济大学）；Phenikaa University（Phenikaa 大学）；Posts and Telecommunications Institute of Technology（邮电技术学院）；Le Quy Don Technical University（黎贵惇技术大学）；VNPT Group（越南邮政电信集团）；MobiFone Corp.（越南移动电信公司）
Few-Shot Network Intrusion Detection Using Online Triplet Mining
Department of Electronics and Electrical Engineering, University of Strathclyde（斯特拉斯克莱德大学电子与电气工程系）；Faculty of Computer and Information Sciences, Ain Shams University（爱思曼大学计算机与信息科学学院）；Faculty of Electrical Engineering, Czech Technical University（捷克技术大学电气工程学院）
Elevating Intrusion Detection and Security Fortification in Intelligent Networks through Cutting-Edge Machine Learning Paradigms
Department of Computer Science and Technology, Beijing Institute of Technology（计算机科学与技术系，北京理工大学）；Department of Quantitative Methods and Economic Informatics, Faculty of Operation and Economics of Transport and Communication, University of Zilina（定量方法与经济信息学系，交通与通信运营经济学院，扎林大学）；Department of Telecommunications, Faculty of Electrical Engineering and Computer Science, VSB-Technical University of Ostrava（电信系，电气工程与计算机科学学院，奥斯特拉瓦技术大学）；Department of AI and Software, Gachon University（人工智能与软件系，高丽大学）；Department of Applied Informatics, Kimyo International University in Tashkent（应用信息学系，塔什干国际大学）
Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network
College of Computer and Information Engineering, Central South University of Forestry and Technology（中南林业科技大学计算机与信息工程学院）；School of Computer Science and Engineering, Central South University（中南大学计算机科学与工程学院）
In the current world, the Internet is being used almost everywhere. With the rise of IoT technology, which is one of the most used technologies, billions of IoT devices are interconnected over the Internet. However, DoS/DDoS attacks are the most frequent and perilous threat to this growing technology. New types of DDoS attacks are highly advanced and complicated, and it is almost impossible to detect or mitigate by the existing intrusion detection systems and traditional methods. Fortunately, Big Data, Data mining, and Machine Learning technologies make it possible to detect DDoS traffic effec…
