Network intrusion detection system: A survey on artificial intelligence‐based techniques

Abstract

High data rate requirements in recent years have resulted in the massive expansion of communication systems, network size and the amount of data generated and processed. This has eventually caused many threats to the communication networks as well due to a more frequent generation of security attacks that are either novel or the mutation of the existing attacks. To secure the networks against such threats, an intrusion detection system (IDS) is considered as one of the promising solutions. The main problem with the IDS is its increased false alarm rate (FAR) in detecting the zero‐day attacks. To improve the detection accuracy and minimizing the FAR, the researchers proposed IDS solutions using artificial intelligence (AI) approaches. In this research, we have systematically reviewed the recent AI‐based network IDS (NIDS) solutions proposed during the period 2016–2021 by the research community. We systematically analysed the proposed NIDS solutions based on their strengths, shortcomings, AI methodology adopted, datasets, and the evaluation metrics used for evaluation purposes. From the review, we observed that the hybrid approach is mostly adopted by the researchers to propose AI‐based NIDS solutions, with a trend shifting to deep learning‐based approaches over the last 2 years. Also, most of the proposed solutions are evaluated using a very old dataset with only a few studies opting for the latest datasets. Finally based on our observations, we highlighted the research challenges and the future research directions to help young researchers to contribute to this field.

Coarse and fine feature selection for Network Intrusion Detection Systems (IDS) in IoT networks

“…It works on the concept that the data points with similar features are likely to belong to the same class 29 . In KNN, the algorithm finds the “k” closest data points (neighbors) in the training dataset and gives the class label that is most common among those neighbors for a particular data point to be classified 19 . The KNN classifier does not require any explicit training phase and can handle binary or multi‐class classification problems 30 .…”

“…29 In KNN, the algorithm finds the "k" closest data points (neighbors) in the training dataset and gives the class label that is most common among those neighbors for a particular data point to be classified. 19 The KNN classifier does not require any explicit training phase and can handle binary or multi-class classification problems. 30 It is a non-parametric and instance-based algorithm, meaning it makes predictions based on the instances themselves rather than building a model.…”

“…Because IoT devices usually use separate communication protocols and have limited functionality, due to this certain attack patterns emerge. 19 Whereas in AIDS the baseline limit is set, if any activity is observed above that defines line IDS raising alarm. The detection accuracy for zero-day attacks and unknown attacks is good, because of the dynamic and developing nature of AIDS in IoT environments, anomaly-based detection is especially important in the context of IoT security.…”

MS‐ADS: Multistage Spectrogram image‐based Anomaly Detection System for IoT security

“…For strengthening the IoT network security, a second protection shield provided by an intrusion detection system (IDS) can be deployed 2,4 . An IDS is a system that can detect intrusions by constantly monitoring the network traffic for any malicious behavior 9 . It can be classified into different types based on its deployment or detection strategy.…”

“…2,4 An IDS is a system that can detect intrusions by constantly monitoring the network traffic for any malicious behavior. 9 It can be classified into different types based on its deployment or detection strategy. Regarding the deployment strategies, the IDS can be host-or network-based.…”