A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications

Abstract

The fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-related attacks are growing rapidly. There are a variety of different attacks including remote-to-user (R2L), user-to-remote (U2R), denial of service (DoS), distributed DDoS, and probing. Firewalls, antivirus scanners, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are widely used to prevent and stop cyber-related attacks. Especially, IDPSs are used to stop and prevent intrusions on communication networks. However, traditional IDSs are no longer effective in detecting complicated cyber attacks from normal network traffic. Because of this, new promising techniques, which specifically utilize data mining, machine learning, and deep learning, need to be proposed in order to distinguish intrusions from normal network traffic. To effectively recognize intrusions, the feature generation, feature selection, and learning processes must be performed delicately before the classification stage. In this study, a new feature selection method called FSAP (Feature Selection Approach) is proposed. In addition, a hybrid attack detection model called SABADT (Signature- and Anomaly-Based Attack Detection Technique) is suggested, which utilizes different classification metrics to recognize attacks. The proposed general method FSACM (Feature Selection and Attack Classification Method) is tested on KDD ’99, UNSW-NB15, and CIC-IDS2017 datasets. According to the experiment results, the proposed method outperformed the state-of-the-art methods in the literature in terms of detection, accuracy, and false-alarm rates.

Mitigating Cyber Anomalies in Virtual Power Plants Using Artificial-Neural-Network-Based Secondary Control with a Federated Learning-Trust Adaptation

“…The VPP devised for this research is structured as a composite system, comprising both a physical layer and a cyber layer [4]. The physical layer, analogous to conventional VPP configurations, encompasses a variety of components, namely DER units, microgrids, ESSs, loads, conventional power plants, and electric vehicles, all interconnected through a communication network [14,15].…”

“…The parameters n Q i and m P i signify the reactive and active droop coefficients, respectively. In order to mitigate voltage and frequency deviations from their nominal values induced by the primary control, a distributed cooperative control strategy [4] is employed. The control protocols pertinent to this study are implemented through a distributed communication network.…”

“…Among distributed control approaches, federated learning (FL) has shown promise, offering enhanced reliability and scalability compared to centralized control [2]. However, the distributed nature of FL renders VPPs more susceptible to physical and cyber anomalies, including poisoning attacks and information compromise in the network [3,4]. These anomalies pose serious threats, leading to system instability and synchronization issues during operation [5].…”

Feature Importance-Based Backdoor Attack in NSL-KDD

“…In Section 2, NIDS covered various machine learning and deep learning models, as well as binary classification and multiclassification when measuring model performance [15][16][17]. Additionally, research has been conducted on diverse DNN structures and models with applied dropout [13], as well as the performance of models based on various feature selections [25,26]. As this study focuses on backdoor attacks in tabular data, a comparison of performance was conducted among fundamental machine learning models, DNN models, and AlertNet with batch normalization and dropout.…”

Multi-Stage Learning Framework Using Convolutional Neural Network and Decision Tree-Based Classification for Detection of DDoS Pandemic Attacks in SDN-Based SCADA Systems

“…With advanced security solutions capable of real-time detection and analysis driven by artificial intelligence, SDN-based SCADA networks can be continuously monitored for suspicious and abnormal activity [10]. By detecting a possible DDoS attack at an earlier stage, secu-rity measures that can reduce the impact of the attack can be taken immediately, and the likelihood of being a direct victim of the attack will be reduced [11].…”