Anomaly-based intrusion detection system using multi-objective grey wolf optimisation algorithm

Al-Amiedy, Taief Alaa; Anbar, Mohammed; Alqattan, Zakaria N. M.; Alzubi, Qusay M.

doi:10.1007/s12652-019-01569-8

Cited by 64 publications

(17 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The results showed to decrease the number of features the use SVM classification network and accuracy and speed to detection. In [54] proposed the anomaly-based ID using a multi-objective grey wolf optimization (GWO) algorithm. The GWO algorithm has been designated as a feature selection NSL-KDD dataset was used to illustrate the usefulness of the approach across multiple attack scenarios.…”

Section: Icmpv6 Machine Learning-based Aidsmentioning

confidence: 99%

Detection of ICMPv6-based DDoS attacks using anomaly based intrusion detection system: A comprehensive review

AIghuraibawi

Abdullah

Manickam

et al. 2021

IJECE

View full text Add to dashboard Cite

Security network systems have been an increasingly important discipline since the implementation of preliminary stages of Internet Protocol version 6 (IPv6) for exploiting by attackers. IPv6 has an improved protocol in terms of security as it brought new functionalities, procedures, i.e., Internet Control Message Protocol version 6 (ICMPv6). The ICMPv6 protocol is considered to be very important and represents the backbone of the IPv6, which is also responsible to send and receive messages in IPv6. However, IPv6 Inherited many attacks from the previous internet protocol version 4 (IPv4) such as distributed denial of service (DDoS) attacks. DDoS is a thorny problem on the internet, being one of the most prominent attacks affecting a network result in tremendous economic damage to individuals as well as organizations. In this paper, an exhaustive evaluation and analysis are conducted anomaly detection DDoS attacks against ICMPv6 messages, in addition, explained anomaly detection types to ICMPv6 DDoS flooding attacks in IPv6 networks. Proposed using feature selection technique based on bio-inspired algorithms for selecting an optimal solution which selects subset to have a positive impact of the detection accuracy ICMPv6 DDoS attack. The review outlines the features and protection constraints of IPv6 intrusion detection systems focusing mainly on DDoS attacks.

show abstract

Section: Icmpv6 Machine Learning-based Aidsmentioning

confidence: 99%

Detection of ICMPv6-based DDoS attacks using anomaly based intrusion detection system: A comprehensive review

AIghuraibawi

Abdullah

Manickam

et al. 2021

IJECE

View full text Add to dashboard Cite

show abstract

“…Various optimization methods are utilized for the feature selection purposes, such as the genetic algorithm [6][7] [8], PSO [9][10] [11], GWO [12] [13]. For feature selection [14][15], a certain hybrid version of the optimization algorithm was used.…”

Section: Features Selectionmentioning

confidence: 99%

Enhanced Simulating Annealing and SVM for Intrusion Detection System in Wireless Sensor Networks

Prabakar

Gomathi

Sasikala

et al. 2021

Preprint

View full text Add to dashboard Cite

Wireless Sensor Networking (WSN) is among the most recent technologies with uses ranging from medicine to the military. Nevertheless, WSNs are impervious to numerous types of cyber-attacks that could compromise the performance of the entire network, which could lead to fatal problems such as a routing attacks, denial-of-service attack, probe, etc. Key management protocols, secure routing, and authentication protocols cannot offer WSN protections for such kinds of attacks. The intrusion detection scheme is the way to solve the issue. This paper proposes an Enhanced simulated annealing based support vector machine algorithm for intrusion detection. Traditional features selection algorithm simulating annealing takes much time to run. So, to avoid this problem, we have introduced Enhanced simulated annealing. From the performance results, it can be seen that our proposed feature selection method provides better performance results than the existing method.

show abstract

“…NIDS are more suited in highspeed network infrastructure, and it is typically used to check network traffic for illegitimate and malicious packets. There are two types of NIDS characterized by the kind of network traffic representation used, either packet-based or flow-based [31], [32], which will be discussed in the following subsections.…”

Section: Network Traffic Representationmentioning

confidence: 99%

Flow-Based Approach to Detect Abnormal Behavior in Neighbor Discovery Protocol (NDP)

et al. 2021

Self Cite

View full text Add to dashboard Cite

Internet Protocol version six (IPv6) is equipped with new protocols, such as the Neighbor Discovery Protocol (NDP). NDP is a stateless protocol without authentication that makes it vulnerable to many types of attacks, such as Router Advertisement (RA) and Neighbour Solicitation (NS) DoS flooding attacks. In these types of attacks, attackers send an enormous volume of abnormal NDP traffic, which causes congestion that degrades network performance. The expected behavior among these attacks is the existence of NDP traffic abnormalities. Thus, this research aims to propose a flow-based approach to detect abnormal NDP traffic behavior, which is considered an indicator of the presence of NDP-based attacks, such as RA and NS DoS flooding attacks. Also, the proposed approach relies on flow-based network traffic representation and adoption of the Entropy algorithm to detect the randomness in the network traffic. The proposed approach is evaluated in terms of detection accuracy, precision, recall, and F1-Score using a simulated dataset. The experimental result shows that the proposed approach obtained 98.1%, 55%, 100%, and 70.96% for average accuracy, precision, recall, and F1-Score, respectively, in detecting abnormal NDP traffic behavior caused by the RA DoS flooding attack. Meanwhile, the proposed approach obtained 99%, 91.3%, 100%, and 95.45% for average accuracy, precision, recall, and F1-Score, respectively, in detecting the abnormal NDP traffic behavior caused by the NS DoS flooding attack. Also, the proposed approach shows better results compared to other existing approaches.

show abstract

Anomaly-based intrusion detection system using multi-objective grey wolf optimisation algorithm

Cited by 64 publications

References 32 publications

Detection of ICMPv6-based DDoS attacks using anomaly based intrusion detection system: A comprehensive review

Detection of ICMPv6-based DDoS attacks using anomaly based intrusion detection system: A comprehensive review

Enhanced Simulating Annealing and SVM for Intrusion Detection System in Wireless Sensor Networks

Flow-Based Approach to Detect Abnormal Behavior in Neighbor Discovery Protocol (NDP)

Contact Info

Product

Resources

About