A Review of Intrusion Detection Systems

Abstract

The transformation of vast amount of information through the network channels appeared widely from one site to another and these information may be disclosed to the third party or the attackers. Thus, the protection process of transformed information is a complex process that can be established through the Intrusion Detection System (IDS). Concealment and unity of information are the most important issues achieved through the intrusion detection system. The process of intrusion detection can be used with wireless or wired networks via making use of hardware or software techniques. Consequently, this caused to have lots of new techniques for IDS in various environments and different levels of network. Unfortunately, most of these techniques do not implemented together for increasing the security of the network. This leaded us to provide a review of the recent papers including a general view of intrusion detection in various environments through the networking and using various techniques. As a result, the most important intend for this paper is to embrace the most new progressions in this region. This may help the researchers to have a general knowledge on different techniques for protection through IDS and various types of intrusion and its detection techniques.

A Systematic Review on Hybrid Intrusion Detection System

“…Denning introduced the technique of detecting intrusion, and since then researchers have worked hard to automatically detect intrusions in network systems [6]. Intrusion detection systems have been defined as the technique of using artificial intelligence, machine learning, and database systems to uncover malicious patterns in large datasets [2]. IDS can be broadly classified into two major categories, anomaly-based IDS and misuse-based IDS.…”

“…ey monitor the normal operations of the system, and if they detect an anomaly, a flag is raised. Instead of keeping all patterns of well-known malicious dataset and updating as new patterns emerge, anomaly detection systems outline "normal" operations of a system and flag anything that deviates from the outline [2]. According to [7], anomaly IDS contains three stages: parameterization, training stage, and detection stage.…”

“…We have two major categories of intrusion detection systems, which include misuse based and anomaly based. Misuse-based IDSs are developed to flag known attacks using patterns of the known attacks [2]. Misuse detection systems use patterns of well-known attacks or weak spots of the system to match and identify known intrusions.…”

Hybrid Intrusion Detection System Based on Data Resampling and Deep Learning

“…Traditional cybersecurity methods (e.g., firewalls, user authentication, and data encryption) cannot handle the complex attacks that take place online. Intrusion detection systems (IDSs) are designed to detect a variety of anomalous patterns that serve as the attack signatures of new and known attacks [3], using advanced database systems with machine learning [4]. When an IDS reports potential malicious activities in an information system [5], it kicks off various analytical and alerting processes to confirm the nature of the attack and launch protection measures.…”

“…(3) To improve data-level class balancing, we provide an ingenious combination of random undersampling (RUS) and synthetic minority oversampling to adjust the data distribution structure and improve minority class detection. (4) To improve algorithm-level class balancing, we apply a hybrid convolutional neural network (CNN) and a Transformer model to adopt new detection performance efficiencies over contemporary models. Our model's performance is compared with that of state-ofthe-art IDS models, demonstrating that our innovations have clear advantages in terms of accuracy, FP rate, and recall.…”