A Comprehensive Systematic Literature Review on Intrusion Detection Systems

Ozkan-Okay, Merve; Samet, Refik; Aslan, Ömer; Gupta, Deepti

doi:10.1109/access.2021.3129336

Cited by 64 publications

(33 citation statements)

References 107 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This is especially true of network-related cyber-attacks security systems, such as IDS and IPS, where the IDS analyzes the signatures of the network traffic and compares them to logged cyber-attacks then the IPS analyzes packets and prevents them based on previously detected attacks that are stored in its database. 11 Therefore, it is essential to forecast new types of cyber-attacks within institutions depending on the environment and in a way that may help detect the patterns of zero-day attacks before they occur. As such, a network cyber-attack forecasting system is essential to increase the level of security at banks and financial institutions.…”

Section: Purposementioning

confidence: 99%

“…A false negative arises when an IDS/IPS classifies an activity as normal when it is actually a cyber-attack. 11 This is often discovered by manually monitoring all hits behaviors and detections on a daily basis. The first draft of the dataset was generated using 3 years of scanned and monitored system data.…”

Section: Analysis and Generation Of The Network Datasetmentioning

confidence: 99%

See 1 more Smart Citation

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions

Qasaimeh

Hammour

Yassein

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

As the number of cyber‐attacks on financial institutions has increased over the past few years, an advanced system that is capable of predicting the target of an attack is essential. Such a system needs to be integrated into the existing detection systems of financial institutions as it provides them with proactive controls with which to halt an attack by predicting patterns. Advanced prediction systems also enhance the software design and security testing of new advanced cyber‐security measures by providing new testing scenarios supported by attack forecasting. This present study developed a model that forecasts future network‐based cyber‐attacks on financial institutions using a deep neural network. The dataset that was used to train and test the model consisted of some of the biggest cyber‐attacks on banking institutions over the past three years. This provided insight into new patterns that may end with a cyber‐crime. These new attacks were also evaluated to determine behavioral similarities with the nearest known attack or a combination of several existing attacks. The performance of the forecasting model was then evaluated in a real banking environment and provided a forecasting accuracy of 90.36%. As such, financial institutions can use the proposed forecasting model to improve their security testing measures.

show abstract

Section: Purposementioning

confidence: 99%

Section: Analysis and Generation Of The Network Datasetmentioning

confidence: 99%

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions

Qasaimeh

Hammour

Yassein

et al. 2022

J Software Evolu Process

View full text Add to dashboard Cite

show abstract

“…In [5], the authors offered a review on IDS technology especially on classification models. Part of the work was to compare on benchmarked Network IDS dataset, for instance,NSL-KDD, ADFA-LD/WD, AWID, UNSW-NB15, CIC-IDS 2017, CIC-DDoS2019 and BoT-IOT.…”

Section: Related Workmentioning

confidence: 99%

“…The data were summarized in a simple tabular form. ADFA, AWID, UNSW-NB15 and CICIDS contained deficiencies and CIC-DDoS2019 and BOT-IoT dataset encompassed latest intrusion traits [5].…”

Section: Related Workmentioning

confidence: 99%

“…Second problem is the authors in [4] concluded that current IDS datasets suffer from realistic network traits. Most public datasets have deficiencies to reflect complex modern network threats [5] [22]. Furthermore, those datasets have redundant records, repetitive features and overlapped label [6] [14].…”

Section: A Summary Of Related Studies (Extended Problem Statement)mentioning

confidence: 99%

See 1 more Smart Citation

Visualizing Realistic Benchmarked IDS Dataset: CIRA-CIC-DoHBrw-2020

et al. 2022

View full text Add to dashboard Cite

Intrusion Detection System (IDS) dataset is crucial to detect lateral movement of cyber-attacks. IDS dataset will help to train the IDS classifier model to achieve earliest detection. A good near-realism public dataset is essential to assist the development of advanced IDS classifier models. However, the available public IDS dataset has long been under scrutiny for its practicality to reflect real low-footprint cyber threats, render real-time network scenario, reflect recent malware attack over newly developed DoH protocol, disregard layer 3 information and finally publish contradictory results of classification and analysis between various studies which makes it non-reproducible and without shareable results. This problem can be resolved by sophisticatedly visualizing a new realistic, real-time, low footprint and up-to-date benchmarked dataset. Visualization helps to detect data deformation before designing the optimized and highly accurate classifier model. Therefore, this study aims to review a new realistic benchmarked IDS dataset and apply sophisticated technique to visualize them. The review starts by carefully examining production network features. These are then compared with various well-established public IDS datasets. Many of them are static, unrealistic metafeatures and disregard source and destination Internet Protocol (IP) information except CIRA-CIC-DoHBrw-2020 dataset. The study then applies Eigen Centrality (EC) technique from the graph theory to visualize this layer 3 (L3) information. Finally, using various visualization techniques such as Principal Component Analysis (PCA) and Gaussian Mixture Model (GMM), the study further analyzes and subsequently visualizes the data. Results show that the CIRA-CIC-DoHBrw-2020 simulated recent malware attack and has a very imbalanced dataset which reflects the realistic low-footprint cyber-attacks. The centrality graph clearly visualizes IPs that are compromised by recent DoH attack in real-time, and the study concludes decisively that smaller packet length of size 1000 to 2000 bytes is to fit an attack trait.

show abstract

A deep and systematic review of the intrusion detection systems in the fog environment

Yi¹,

Yin²,

Darbandi

2022

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Fog computing has arisen to complement cloud computing, offering a cost-effective architecture to power the Internet of things. Fog computing is a network computing and service paradigm that expands cloud computing and services to the network's edge to solve the cloud's fundamental shortcomings, like a lack of location awareness, mobility, and latency. Besides, fog devices may have security issues because fog nodes are near end-users and have limited computational power. As the linked devices in the Internet of things grow exponentially, so does the potential for cyber-attack. Intrusion detection systems have been developed as a feasible tool for detecting and preventing harmful activity in this vein. This work used a systematic literature review to examine intrusion detection system approaches in a fog environment. By categorizing intrusion detection systems in the literature, we produce a review. An intrusion detection system's characteristic is early identification of an attack and the decrease of false alarms as a result. Some of the issues that these systems' designers will face are also discussed. Recall rate, detection rates, detection delay, and detection precision were the parameters that received the most attention. This report will serve as a roadmap for future network intrusion detection studies in fog computing. 1• Numerous fog nodes are managed and controlled by a cloud computing center.

show abstract

A Comprehensive Systematic Literature Review on Intrusion Detection Systems

Cited by 64 publications

References 107 publications

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions

Visualizing Realistic Benchmarked IDS Dataset: CIRA-CIC-DoHBrw-2020

A deep and systematic review of the intrusion detection systems in the fog environment

Contact Info

Product

Resources

About