Search Results for « Intrusion Detection System »

This work applies machine learning techniques to improve network intrusion detection using the CIC-IDS-2017 dataset, which includes realistic examples of both normal and attack traffic. Traditional intrusion detection systems rely on static signatures, making it difficult to recognize new or evolving attack patterns. To overcome this limitation, the dataset was preprocessed, analyzed, and optimized using Recursive Feature Elimination (RFE) to identify the most relevant flow-based features for anomaly detection. The results show that features related to average packet size, forward and backward packet length behavior, packet timing, destination ports, and total packet volume provide the highest impact on model performance. Several supervised learning algorithms were trained and compared, including Logistic Regression, KNN, Decision Tree, Random Forest, XGBoost, CatBoost, and a Voting Classifier. The evaluation demonstrates that ensemble models consistently achieve over 99% accuracy, outperforming simpler classifiers. These findings suggest that feature-optimized machine learning approaches can significantly improve intrusion detection accuracy and support future development of real-time detection systems.

As the Internet of Things (IoT) continues to grow, a vast amount of data is generated. The IoT environment is quite sensitive to security challenges because personal information may be leaked or sensor data may be manipulated, which could cause accidents. Because traditional intrusion detection system (IDS) studies are often designed to work well on datasets, it is unknown whether they would work well in a changing network environment. In addition, IDSs for protecting IoT environments have been studied, but their performance was verified using datasets unrelated to the IoT, so it is not known whether the performance would be effective in an IoT environment. In this study, we propose an intrusion detection hyperparameter control system (ID-HyConSys) that automates the IDS using proximal policy optimization (PPO) to solve these problems and reliably protect the IoT environment. ID-HyConSys consists of an intrusion detection module consisting of a deep neural network (DNN) feature extractor that extracts efficient features from a changing network environment, a k-means cluster that clusters the extracted data, and a PPO agent that automates the IDS through learning and control. Through experimentation, it was confirmed that the hidden layer configuration, the number of feature extractions by the DNN feature extractor, and the number of clusters in the k-means cluster significantly affected the intrusion detection performance. The PPO directly controls these hyperparameters and determines the optimized value itself. The performance of ID-HyConSys was evaluated using the CICIDS2017 and MQTTset datasets. An F1-score of 0.9707 on CICIDS2017 and an F1-score of 0.9973 on the MQTTset were obtained. Finally, we merged the two datasets and obtained an F1-score of 0.9901. The superiority of the ID-HyConSys proposed in this study was confirmed because ID-HyConSys showed high performance on each dataset and, at the same time, very high performance on complex merged datasets. ID-HyConSys is expected to protect the IoT environment more quickly and safely by automatically learning network changes and adjusting the intrusion detection module accordingly.

Abstract While Cyber-Manufacturing System security must involve three separate yet interrelated processes (prediction, detection, and prevention), the detection process is the focus of research presented in this paper. Current intrusion detection systems often result in high false positive and false negative rates. Also, the actual detection time may take long time-up to several months. The current intrusion detection systems rely heavily on the network data, but do not utilize the physical data such as side channel, sensor reading, image, keystrokes., which are generated during manufacturing processes. An adaptive intrusion detection system composed of two security layers is proposed to detect cyber-physical intrusions. Model-free deep reinforcement learning is used in the two security layers: the network layer and the physical layer. The capability of reinforcement learning through trial and error and a course of actions based on observations in an environment makes it more robust to the continuously changing attack vectors in current manufacturing industry. The proposed intrusion detection system demonstrates that it can reduce the false positive rate and generate alerts to a wide range of attack patterns.