Intrusion detection plays an important role in ensuring information security, and the key technology is to accurately identify various attacks in the network. In this paper, we explore how to model an intrusion detection system based on deep learning, and we propose a deep learning approach for intrusion detection using recurrent neural networks (RNN-IDS). Moreover, we study the performance of the model in binary classification and multiclass classification, and the number of neurons and different learning rate impacts on the performance of the proposed model. We compare it with those of J48, artificial neural network, random forest, support vector machine, and other machine learning methods proposed by previous researchers on the benchmark data set. The experimental results show that RNN-IDS is very suitable for modeling a classification model with high accuracy and that its performance is superior to that of traditional machine learning classification methods in both binary and multiclass classification. The RNN-IDS model improves the accuracy of the intrusion detection and provides a new research method for intrusion detection.

A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks

The Internet of Things (IoT) integrates billions of smart devices that can communicate with one another with minimal human intervention. IoT is one of the fastest developing fields in the history of computing, with an estimated 50 billion devices by the end of 2020. However, the crosscutting nature of IoT systems and the multidisciplinary components involved in the deployment of such systems have introduced new security challenges. Implementing security measures, such as encryption, authentication, access control, network and application security for IoT devices and their inherent vulnerabilities is ineffective. Therefore, existing security methods should be enhanced to effectively secure the IoT ecosystem. Machine learning and deep learning (ML/DL) have advanced considerably over the last few years, and machine intelligence has transitioned from laboratory novelty to practical machinery in several important applications. Consequently, ML/DL methods are important in transforming the security of IoT systems from merely facilitating secure communication between devices to security-based intelligence systems. The goal of this work is to provide a comprehensive survey of ML methods and recent advances in DL methods that can be used to develop enhanced security methods for IoT systems. IoT security threats that are related to inherent or newly introduced threats are presented, and various potential IoT system attack surfaces and the possible threats related to each surface are discussed. We then thoroughly review ML/DL methods for IoT security and present the opportunities, advantages and shortcomings of each method. We discuss the opportunities and challenges involved in applying ML/DL to IoT security. These opportunities and challenges can serve as potential future research directions.

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

Machine learning algorithms for wireless sensor networks: A survey

More and more network traffic data have brought great challenge to traditional intrusion detection system. The detection performance is tightly related to selected features and classifiers, but traditional feature selection algorithms and classification algorithms can’t perform well in massive data environment. Also the raw traffic data are imbalanced, which has a serious impact on the classification results. In this paper, we propose a novel network intrusion detection model utilizing convolutional neural networks (CNNs). We use CNN to select traffic features from raw data set automatically, and we set the cost function weight coefficient of each class based on its numbers to solve the imbalanced data set problem. The model not only reduces the false alarm rate (FAR) but also improves the accuracy of the class with small numbers. To reduce the calculation cost further, we convert the raw traffic vector format into image format. We use the standard NSL-KDD data set to evaluate the performance of the proposed CNN model. The experimental results show that the accuracy, FAR, and calculation cost of the proposed model perform better than traditional standard algorithms. It is an effective and reliable solution for the intrusion detection of a massive network.

A Novel Intrusion Detection Model for a Massive Network Using Convolutional Neural Networks

The network intrusion detection system is an important tool for protecting computer networks against threats and malicious attacks. Many techniques have recently been proposed; however, these techniques face significant challenges due to the continuous emergence of new threats that are not recognized by the existing detection systems. In this paper, we propose a novel two-stage deep learning model based on a stacked auto-encoder with a soft-max classifier for efficient network intrusion detection. The model comprises two decision stages: an initial stage responsible for classifying network traffic as normal or abnormal using a probability score value. This is then used in the final decision stage as an additional feature for detecting the normal state and other classes of attacks. The proposed model is able to learn useful feature representations from large amounts of unlabeled data and classifies them automatically and efficiently. To evaluate and test the effectiveness of the proposed model, several experiments are conducted on two public datasets: an older benchmark dataset, the KDD99, and a newer one, the UNSW-NB15. The comparative experimental results demonstrate that our proposed model significantly outperforms the existing models and methods and achieves high recognition rates, up to 99.996% and 89.134%, for the KDD99 and UNSW-NB15 datasets, respectively. We conclude that our model has the potential to serve as a future benchmark for deep learning and network security research communities.

/pdf/tsdl-a-two-stage-deep-learning-model-for-efficient-network-2lbyda8jz1.pdf

TSDL: A Two-Stage Deep Learning Model for Efficient Network Intrusion Detection

The Internet of Things has broad application in military field, commerce, environmental monitoring, and many other fields. However, the open nature of the information media and the poor deployment environment have brought great risks to the security of wireless sensor networks, seriously restricting the application of wireless sensor network. Internet of Things composed of wireless sensor network faces security threats mainly from Dos attack, replay attack, integrity attack, false routing information attack, and flooding attack. In this paper, we proposed a new intrusion detection system based on -nearest neighbor (-nearest neighbor, referred to as KNN below) classification algorithm in wireless sensor network. This system can separate abnormal nodes from normal nodes by observing their abnormal behaviors, and we analyse parameter selection and error rate of the intrusion detection system. The paper elaborates on the design and implementation of the detection system. This system has achieved efficient, rapid intrusion detection by improving the wireless ad hoc on-demand distance vector routing protocol (Ad hoc On-Demand Distance the Vector Routing, AODV). Finally, the test results show that: the system has high detection accuracy and speed, in accordance with the requirement of wireless sensor network intrusion detection.

/pdf/a-new-intrusion-detection-system-based-on-knn-classification-2sz3g7pxhy.pdf

A New Intrusion Detection System Based on KNN Classification Algorithm in Wireless Sensor Network

The invention discloses a thing network attack detection system which is composed of a wireless network interface module, a data storage module, an analyzing judgment module and an invasion responding module. The input end of the wireless network interface module is connected with the network, the output end is connected with the input end of the data storage module, the output end of the data storage module is connected with the input end of the analyzing judgment module, the output end of the analyzing judgment module is connected with the input end of the invasion responding module, and the output end of the invasion responding module is connected with the second input end of the wireless network interface module. The system effectively avoids flood attack, enables the thing network to achieve more defending characteristics, and lays a solid foundation for developers to achieve a beating back function.

Li Wenchao

Papers

A New Intrusion Detection System Based on KNN Classification Algorithm in Wireless Sensor Network

Thing network attack detection system and method