Performance Study of Distributed Multi-Agent Intrusion Detection System

Traditional Intrusion Detection System （IDS） based on hosts or networks no longer meets the security requirements in today＇s network environment due to the increasing complexity and distributivity. A multi-agent distributed IDS model, enhanced with a method of computing its statistical values of performance is presented. This model can accomplish not only distributed information collection, but also distributed intrusion detection and real-time reaction. Owing to prompt reaction and openness, it can detect intrusion behavior of both known and unknown sources. According to preliminary tests, the accuracy ratio of intrusion detection is higher than 92% on the average.

Enhancing Internet of Things Intrusion Detection Using Artificial Intelligence

Escalating cyber security threats and the increased use of Internet of Things(IoT)devices require utilisation of the latest technologies available to supply adequate protection.The aim of Intrusion Detection Systems(IDS)is to prevent malicious attacks that corrupt operations and interrupt data flow,which might have significant impact on critical industries and infrastructure.This research examines existing IDS,based on Artificial Intelligence(AI)for IoT devices,methods,and techniques.The contribution of this study consists of identification of the most effective IDS systems in terms of accuracy,precision,recall and F1-score;this research also considers training time.Results demonstrate that Graph Neural Networks(GNN)have several benefits over other traditional AI frameworks through their ability to achieve in excess of 99%accuracy in a relatively short training time,while also capable of learning from network traffic the inherent characteristics of different cyber-attacks.These findings identify the GNN(a Deep Learning AI method)as the most efficient IDS system.The novelty of this research lies also in the linking between high yielding AI-based IDS algorithms and the AI-based learning approach for data privacy protection.This research recommends Federated Learning(FL)as the AI training model,which increases data privacy protection and reduces network data flow,resulting in a more secure and efficient IDS solution.

Intelligent Intrusion Detection System Model Using Rough Neural Network

A model of intelligent intrusion detection based on rough neural network (RNN), which combines the neural network and rough set, is presented. It works by capturing network packets to identify network intrusions or malicious attacks using RNN with sub-nets. The sub-net is constructed by detection-oriented signatures extracted using rough set theory to detect different intrusions. It is proved that RNN detection method has the merits of adaptive, high universality, high convergence speed, easy upgrading and management.

Intrusion Detection in the Internet of Things Using Fusion of GRU-LSTM Deep Learning Model

Cybersecurity threats are increasing rapidly as hackers use advanced techniques.As a result,cybersecurity has now a significant factor in protecting organizational limits.Intrusion detection systems(IDSs)are used in networks to flag serious issues during network management,including identifying malicious traffic,which is a challenge.It remains an open contest over how to learn features in IDS since current approaches use deep learning methods.Hybrid learning,which combines swarm intelligence and evolution,is gaining attention for further improvement against cyber threats.In this study,we employed a PSO-GA(fusion of particle swarm optimization(PSO)and genetic algorithm(GA))for feature selection on the CICIDS-2017 dataset.To achieve better accuracy,we proposed a hybrid model called LSTM-GRU of deep learning that fused the GRU(gated recurrent unit)and LSTM(long short-term memory).The results show considerable improvement,detecting several network attacks with 98.86%accuracy.A comparative study with other current methods confirms the efficacy of our proposed IDS scheme.

General Study of Mobile Agent Based Intrusion Detection System (IDS)

The extensive access of network interaction has made present networks more responsive to earlier intrusions. In distributed network intrusions, there are many computing nodes that are assisted by intruders. The evidence of intrusions is to be associated from all the held up nodes. From the last few years, mobile agent based technique in intrusion detection system (IDS) has been widely used to detect intrusion over distributed network. This paper presented survey of several existing mobile agent based intrusion detection system and comparative analysis report between them. Furthermore we have focused on each attribute of analysis, for example technique (NIDS, HIDS or Hybrid), behavior layer, detection techniques for analysis, uses of mobile agent and technology used by existing IDS, strength and issues. Their strengths and issues are situational wherever appropriate. We have observed that some of the existing techniques are used in IDS which causes low detection rate, behavior layers like TCP connection for packet capturing which is most important activity in NIDS and response time (technology execution time) with memory consumption by mobile agent as major issues.

A Hierarchy Distributed-Agents Model for Network Risk Evaluation Based on Deep Learning

Deep Learning presents a critical capability to be geared into environments being constantly changed and ongoing learning dynamic,which is especially relevant in Network Intrusion Detection.In this paper,as enlightened by the theory of Deep Learning Neural Networks,Hierarchy Distributed-Agents Model for Network Risk Evaluation,a newly developed model,is proposed.The architecture taken on by the distributed-agents model are given,as well as the approach of analyzing network intrusion detection using Deep Learning,the mechanism of sharing hyper-parameters to improve the efficiency of learning is presented,and the hierarchical evaluative framework for Network Risk Evaluation of the proposed model is built.Furthermore,to examine the proposed model,a series of experiments were conducted in terms of NSLKDD datasets.The proposed model was able to differentiate between normal and abnormal network activities with an accuracy of 97.60%on NSL-KDD datasets.As the results acquired from the experiment indicate,the model developed in this paper is characterized by high-speed and high-accuracy processing which shall offer a preferable solution with regard to the Risk Evaluation in Network.

A High-level Architecture for Intrusion Detection on Heterogeneous Wireless Sensor Networks: Hierarchical, Scalable and Dynamic Reconfigurable

Networks protection against different types of attacks is one of most important posed issue into the network and information security domains. This problem on Wireless Sensor Networks (WSNs), in attention to their special properties, has more importance. Now, there are some of proposed solutions to protect Wireless Sensor Networks (WSNs) against different types of intrusions;but no one of them has a comprehensive view to this problem and they are usually designed in single-purpose;but, the proposed design in this paper has been a comprehensive view to this issue by presenting a complete Intrusion Detection Architecture (IDA). The main contribution of this architecture is its hierarchical structure;i.e. it is designed and applicable, in one, two or three levels, consistent to the application domain and its required security level. Focus of this paper is on the clustering WSNs, designing and deploying Sensor-based Intrusion Detection System (SIDS) on sensor nodes, Cluster-based Intrusion Detection System (CIDS) on cluster-heads and Wireless Sensor Network wide level Intrusion Detection System (WSNIDS) on the central server. Suppositions of the WSN and Intrusion Detection Architecture (IDA) are: static and heterogeneous network, hierarchical, distributed and clustering structure along with clusters' overlapping. Finally, this paper has been designed a questionnaire to verify the proposed idea;then it analyzed and evaluated the acquired results from the questionnaires.

Optimal Machine Learning Enabled Intrusion Detection in Cyber-Physical System Environment

Cyber-attacks on cyber-physical systems(CPSs)resulted to sensing and actuation misbehavior,severe damage to physical object,and safety risk.Machine learning(ML)models have been presented to hinder cyberattacks on the CPS environment;however,the non-existence of labelled data from new attacks makes their detection quite interesting.Intrusion Detection System(IDS)is a commonly utilized to detect and classify the existence of intrusions in the CPS environment,which acts as an important part in secure CPS environment.Latest developments in deep learning(DL)and explainable artificial intelligence(XAI)stimulate new IDSs to manage cyberattacks with minimum complexity and high sophistication.In this aspect,this paper presents an XAI based IDS using feature selection with Dirichlet Variational Autoencoder(XAIIDS-FSDVAE)model for CPS.The proposed model encompasses the design of coyote optimization algorithm(COA)based feature selection(FS)model is derived to select an optimal subset of features.Next,an intelligent Dirichlet Variational Autoencoder(DVAE)technique is employed for the anomaly detection process in the CPS environment.Finally,the parameter optimization of the DVAE takes place using a manta ray foraging optimization(MRFO)model to tune the parameter of the DVAE.In order to determine the enhanced intrusion detection efficiency of the XAIIDS-FSDVAE technique,a wide range of simulations take place using the benchmark datasets.The experimental results reported the better performance of the XAIIDSFSDVAE technique over the recent methods in terms of several evaluation parameters.

基于Agent人工智能的异构网络多重覆盖节点入侵检测系统设计

异构网络具有结构复杂、多重覆盖面积大等特征,使得网络入侵检测较为隐蔽,威胁网络运行的安全性;为此,对基于Agent人工智能的异构网络多重覆盖节点入侵检测系统进行了研究;通过检测Agent和通信Agent装设主机Agent,以Cisco Stealthwatch流量传感器作为异构网络传感器检测攻击行为,采用STM32L151RDT664位微控制器传输批量数据,由MAX3232芯片实现系统电平转化,实现硬件系统设计;软件部分设计入侵检测标准,采用传感器设备捕获网络实时数据,通过Agent技术解析异构网络协议并提取数据运行特征,综合考虑协议解析结果及与检测标准匹配度,实现异构网络多重覆盖节点入侵检测;经实验测试表明,基于Agent人工智能的异构网络多重覆盖节点入侵检测系统入侵行为的漏检率和入侵类型误检率的平均值仅为6%和5%,能够有效提高检测精度,减小检测误差。

Multi-agent cooperative intrusion response in mobile adhoc networks

The nature of adhoc networks makes them vulnerable to security attacks. Many security technologies such as intrusion prevention and intrusion detection are passive in response to intrusions in that their countermea- sures are only to protect the networks, and there is no automated network-wide counteraction against detected intrusions, the architecture of cooperation intrusion response based multi-agent is propose. The architecture is composed of mobile agents. Monitor agent resides on every node and monitors its neighbor nodes. Decision agent collects information from monitor nodes and detects an intrusion by security policies. When an intruder is found in the architecture, the block agents will get to the neighbor nodes of the intruder and form the mobile firewall to isolate the intruder. In the end, we evaluate it by simulation.

Multi-Agent Network Intrusion Active Defense Model Based on Immune Theory

Inspired by the immune theory and multi-agent systems, an immune multi-agent active defense model for network intrusion is established. The concept of immune agent is introduced, and its running mechanism is established. The method, which uses antibody concentration to quantitatively describe the degree of intrusion danger, is presented. This model implements the multi-layer and distributed active defense mechanism for network intrusion. The experiment results show that this model is a good solution to the network security defense.

Developing a Secure Framework Using Feature Selection and Attack Detection Technique

Intrusion detection is critical to guaranteeing the safety of the data in the network.Even though,since Internet commerce has grown at a breakneck pace,network traffic kinds are rising daily,and network behavior characteristics are becoming increasingly complicated,posing significant hurdles to intrusion detection.The challenges in terms of false positives,false negatives,low detection accuracy,high running time,adversarial attacks,uncertain attacks,etc.lead to insecure Intrusion Detection System(IDS).To offset the existing challenge,the work has developed a secure Data Mining Intrusion detection system(DataMIDS)framework using Functional Perturbation(FP)feature selection and Bengio Nesterov Momentum-based Tuned Generative Adversarial Network(BNM-tGAN)attack detection technique.The data mining-based framework provides shallow learning of features and emphasizes feature engineering as well as selection.Initially,the IDS data are analyzed for missing values based on the Marginal Likelihood Fisher Information Matrix technique(MLFIMT)that identifies the relationship among the missing values and attack classes.Based on the analysis,the missing values are classified as Missing Completely at Random(MCAR),Missing at random(MAR),Missing Not at Random(MNAR),and handled according to the types.Thereafter,categorical features are handled followed by feature scaling using Absolute Median Division based Robust Scalar(AMDRS)and the Handling of the imbalanced dataset.The selection of relevant features is initiated using FP that uses‘3’Feature Selection(FS)techniques i.e.,Inverse Chi Square based Flamingo Search(ICS-FSO)wrapper method,Hyperparameter Tuned Threshold based Decision Tree(HpTT-DT)embedded method,and Xavier Normal Distribution based Relief(XavND-Relief)filter method.Finally,the selected features are trained and tested for detecting attacks using BNM-tGAN.The Experimental analysis demonstrates that the introduced DataMIDS framework produces an accurate diagnosis about the attack with low computation time.The work avoids false alarm rate of attacks and remains to be relatively robust against malicious attacks as compared to existing methods.

基于人工智能的网络入侵检测与响应机制

针对当前网络入侵检测领域的挑战,提出了一种基于改进型朴素贝叶斯算法的网络入侵检测方法。首先,深入研究了网络入侵检测与响应的整体框架;其次,提出了改进型朴素贝叶斯算法,引入了特征加权和条件概率平滑策略,以提高对入侵行为检测的准确性;最后,利用CIC-IDS2017数据集进行实验验证,并与传统朴素贝叶斯方法进行比较。实验结果表明,改进型朴素贝叶斯方法的多个指标均优于传统方法,充分证明了其在网络入侵检测中的有效性。

基于Agent的分布式入侵检测系统模型

提出了一个基于 Agent的分布式入侵检测系统模型框架 .该模型提供了基于网络和基于主机入侵检测部件的接口 ,为不同 Agent的相互协作提供了条件 .在分布式环境中 ,按照系统和网络的异常使用模式的不同特征和环境差异 ,可利用不同的 Agent进行检测 ,各 Agent相互协作 ,检测异常行为 .该模型是一个开放的系统模型 ,具有很好的可扩充性 ,易于加入新的协作主机和入侵检测 Agent,也易于扩充新的入侵检测模式 .它采用没有中心控制模块的并行 Agent检测模式 ,各 Agent之间的协作是通过它们之间的通信来完成的 ,各 Agent之间可以交流可疑信息和进行数据收集 .Agent之间各自独立 ,相互协作 ,合作完成检测任务 .另外 ,模型采用一定的状态检查和验证策略 ,保证了 Agent的自身安全和通信安全 .该模型与特定的系统应用环境无关 ,因此 。

基于博弈论的入侵检测与响应优化综述

当前网络规模急剧增加,各类入侵过程也逐渐向复杂化、多样化的趋势发展。网络攻击带来的损失越来越严重,针对各类安全事件的检测发现以及查处响应也变得日益困难。为了快速识别各类网络安全事件并做出相应的响应,入侵检测与响应技术变得越来越重要。入侵检测系统(IDS)能否识别复杂的攻击模式以及分析大量的网络流量主要取决于其精度和配置,这使得入侵检测与响应的优化问题成为网络与系统安全的重要需求,并且成为一个活跃的研究主题。现有的研究成果已经提出了很多可以优化入侵检测和响应效率的方法,其中,将博弈论应用在入侵检测与响应的研究日益增多。博弈论提供了一种框架去捕获攻击者和防御者的交互,采用了一种定量的方法评估系统的安全性。本文在分析了入侵检测与响应系统和博弈论的基本原理的基础上,介绍了当前基于博弈论的入侵检测与响应优化问题的现有解决方案,并且讨论了这些解决方案的局限性以及给出了未来的研究方向。首先,详细介绍了入侵检测与博弈论的背景知识,回顾了常用的入侵检测系统基本原理,评估方法,常用的数据集以及经典的安全领域中的博弈论模型。其次,按照基于博弈论的入侵检测与响应优化问题的类型进行了分类介绍,根据攻击的先后顺序对网络安全架构优化、IDS配置与效率优化、IDS的自动化响应优化以及分布式入侵检测架构优化等技术的研究现状进行归纳、分析、总结,并分析了现有方案的优缺点,进而分析可能的解决方案。然后针对将博弈论应用于入侵检测与响应中面临的挑战进行了分析与讨论。最后展望了未来的研究方向以及发展趋势。

基于Agent的网络入侵检测技术的研究

入侵检测作为一种主动的信息安全保障措施,已成为计算机安全特别是网络安全领域的研究热点。基于A-gent技术的入侵检测系统因为其分布式协同处理和智能化的特点,正引起研究者的重视并成为未来入侵检测的一个发展方向。本文首先介绍了入侵检测系统的发展、分类与演变过程,然后分别对基于静态Agent与移动Agent技术的入侵检测系统的研究现状进行了阐述,分析了它们的研究重点与发展方向,最后指出了基于Agent技术的入侵检测系统的研究展望和面临的挑战。

一个基于移动Agent的分布式入侵检测系统

目的 针对当前入侵检测系统扩展性、容错性和适应性差的问题,提出并重点研究了一个将移动Agent技术应用于分布式网络监测和入侵检测系统的技术方案。方法 设计并实现了一个基于移动Agent技术的网络监测和入侵检测系统,分析讨论了系统体系结构、功能设置、移动Agent组成与应用等问题。结果 所设计的系统具有分布、异构、灵活和可扩充的优点。结论 所完成的工作对大型网络应用和网络管理系统的开发有一定借鉴意义。

一种基于Agent的并行分布式四层入侵检测系统体系结构

该文针对信息安全领域中的入侵检测问题,给出了一种潜在解决方案。它将人工智能和信息安全结合起来工作,提出了一种入侵检测的四层体系结构。重点介绍了四层体系结构中的代理层是怎样通过使用自治代理(AutonomousAgent)实现的。

一种基于移动agent的分布式入侵检测系统

网络的发展带来了入侵的风险,为了防止入侵和破坏,出现了入侵检测技术,传统的入侵检测技术检测能力差、效率低,该文提出了一种基于移动agent的分布式入侵检测系统。

基于自治Agent的入侵检测系统模型

利用自治Agent的良好特性，提出了一个基于自治多Agent入侵检测系统模型。讨论了结构中各组件的功能以及多Agent系统中关键的通信机制问题，并分析了一个实例。