An intrusion detection system using optimized deep neural network architecture

Ramaiah, Mangayarkarasi; Vanmathi, C; Ravi, Vinayakumar; Kumar, Neeraj

doi:10.1002/ett.4221

Cited by 45 publications

(29 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Specifically, various Machine Learning (ML) and Deep Learning (DL) models have been developed to classify network traffic data in IoT networks. These models learn the discriminating features of benign traffic and malicious traffic using different architectures such as Random Forest (RF) [ 18 ], Support Vector Machine (SVM) [ 19 ], Deep Neural Network (DNN) [ 20 ], Recurrent Neural Network (RNN) [ 21 ], Long Short-Term Memory (LSTM) [ 22 ] and Gated Recurrent Unit (GRU) [ 23 ]. For an in-depth understanding, comprehensive reviews and surveys on the application of ML and DL in intrusion detection are presented in [ 24 , 25 , 26 , 27 , 28 , 29 ].…”

Section: Introductionmentioning

confidence: 99%

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

View full text Add to dashboard Cite

Nowadays, hackers take illegal advantage of distributed resources in a network of computing devices (i.e., botnet) to launch cyberattacks against the Internet of Things (IoT). Recently, diverse Machine Learning (ML) and Deep Learning (DL) methods were proposed to detect botnet attacks in IoT networks. However, highly imbalanced network traffic data in the training set often degrade the classification performance of state-of-the-art ML and DL models, especially in classes with relatively few samples. In this paper, we propose an efficient DL-based botnet attack detection algorithm that can handle highly imbalanced network traffic data. Specifically, Synthetic Minority Oversampling Technique (SMOTE) generates additional minority samples to achieve class balance, while Deep Recurrent Neural Network (DRNN) learns hierarchical feature representations from the balanced network traffic data to perform discriminative classification. We develop DRNN and SMOTE-DRNN models with the Bot-IoT dataset, and the simulation results show that high-class imbalance in the training data adversely affects the precision, recall, F1 score, area under the receiver operating characteristic curve (AUC), geometric mean (GM) and Matthews correlation coefficient (MCC) of the DRNN model. On the other hand, the SMOTE-DRNN model achieved better classification performance with 99.50% precision, 99.75% recall, 99.62% F1 score, 99.87% AUC, 99.74% GM and 99.62% MCC. Additionally, the SMOTE-DRNN model outperformed state-of-the-art ML and DL models.

show abstract

Section: Introductionmentioning

confidence: 99%

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

View full text Add to dashboard Cite

show abstract

“…The integrity of the data captured is preserved using a homomorphic encryption scheme. 35 This step is mainly done to ensure the privacy of the data processed. The network traffic captured is preprocessed to remove the noise present in the dataset and enhance the speed of the training process.…”

Section: Proposed Iot Based Cyber Forensics Architecturementioning

confidence: 99%

IoT based cyber forensics in big data optimization and privacy using deep neural anomaly detection with Hadoop clustering and convolution based Adam optimizer

Venugopal¹,

Rengaswamy

Sathianesan

2022

Concurrency and Computation

View full text Add to dashboard Cite

The reliability of the digital forensic system mainly lies in its ability to detect the attack on time and minimize the security risk associated with the Internet of Things (IoT) device. The existing machine learning architectures mainly suffered from different complexities while processing the attack features such as increased processing time, high manual intervention, complexity to handle large datasets, and low prediction accuracy. To overcome these issues, this article proposes a novel deep learning architecture for data forensics. The low generalization capability of the neural network is handled via the Hadoop clustering and convolution‐based ADAM (CADAM) optimizer approach for improving the optimization capability of the model. In this way, the privacy of the model is improved. The efficiency of the proposed CADAM optimized deep neural network architecture is evaluated by using the UNSW‐NB15 and Bot‐IoT datasets. The proposed model offers improved performance in terms of runtime, precision, sensitivity, specificity, latency, cost, ROCAUC curve, and anomalous traffic when compared with the existing techniques. From the experiments carried out, we can conclude that the proposed framework revealed higher performance to discover and prevent cyber‐attacks against other conventional approaches.

show abstract

“…It is mainly composed of an agent, an analysis engine, and a response module. Several IDS-based security solutions were developed in the previous year [15][16][17][18][19][20][21][22][23][24][25]. But, these IDS-based security solutions cannot cope with the MEC architecture due to the changing behavior of users and devices.…”

Section: Problem Formulationmentioning

confidence: 99%

An edge based hybrid intrusion detection framework for mobile edge computing

Singh

Chatterjee

Satapathy

2021

Complex Intell. Syst.

View full text Add to dashboard Cite

The Mobile Edge Computing (MEC) model attracts more users to its services due to its characteristics and rapid delivery approach. This network architecture capability enables users to access the information from the edge of the network. But, the security of this edge network architecture is a big challenge. All the MEC services are available in a shared manner and accessed by users via the Internet. Attacks like the user to root, remote login, Denial of Service (DoS), snooping, port scanning, etc., can be possible in this computing environment due to Internet-based remote service. Intrusion detection is an approach to protect the network by detecting attacks. Existing detection models can detect only the known attacks and the efficiency for monitoring the real-time network traffic is low. The existing intrusion detection solutions cannot identify new unknown attacks. Hence, there is a need of an Edge-based Hybrid Intrusion Detection Framework (EHIDF) that not only detects known attacks but also capable of detecting unknown attacks in real time with low False Alarm Rate (FAR). This paper aims to propose an EHIDF which is mainly considered the Machine Learning (ML) approach for detecting intrusive traffics in the MEC environment. The proposed framework consists of three intrusion detection modules with three different classifiers. The Signature Detection Module (SDM) uses a C4.5 classifier, Anomaly Detection Module (ADM) uses Naive-based classifier, and Hybrid Detection Module (HDM) uses the Meta-AdaboostM1 algorithm. The developed EHIDF can solve the present detection problems by detecting new unknown attacks with low FAR. The implementation results illustrate that EHIDF accuracy is 90.25% and FAR is 1.1%. These results are compared with previous works and found improved performance. The accuracy is improved up to 10.78% and FAR is reduced up to 93%. A game-theoretical approach is also discussed to analyze the security strength of the proposed framework.

show abstract

An intrusion detection system using optimized deep neural network architecture

Cited by 45 publications

References 33 publications

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

IoT based cyber forensics in big data optimization and privacy using deep neural anomaly detection with Hadoop clustering and convolution based Adam optimizer

An edge based hybrid intrusion detection framework for mobile edge computing

Contact Info

Product

Resources

About