Résultats de recherche pour « Network Intrusion Detection Systems »

Abstract A main function of network Intrusion Detection Systems (NIDSs) is to monitor network traffic and match it against rules. Oblivious NIDSs (O-NIDS) perform the same tasks of NIDSs but they use encrypted rules and produce encrypted results without being able to decrypt the rules or the results. Current implementations of O-NIDS suffer from slow searching speeds and/or lack of generality. In this paper we present a generic approach to implement a privacy-preserving O-NIDS based on hybrid binary gates. We also present two resources-flexible algorithm bundles built upon the hybrid binary gates to perform the NIDS's essential tasks of direct matching and range matching as a proof of concept. Our approach utilizes a Homomorphic Encryption (HE) layer in an abstract fashion, which makes it implementable by many HE schemes compared to the state of the art where the underlying HE scheme is a core part of the approach. This feature allowed using already-existing HE libraries that utilize parallelization techniques in GPUs for faster performance. We achieved a rule encryption time as low as 0.012\% of the state of the art with only 0.047\% of its encrypted rule size. Also, we achieved a rule matching speed that is almost 20,000 times faster than the state of the art.

Abstract Explainability and evaluation of AI models are crucial parts of the security of modern intrusion detection systems (IDS) in the network security field, yet they are lacking. Accordingly, feature selection is essential for such parts in IDS because it identifies the most paramount features, enhancing attack detection and its description. In this work, we tackle feature selection problem for IDS via suggesting new ways of applying eXplainable AI (XAI) methods for this problem. We identify the crucial attributes originated by distinct AI methods in tandem with novel five attribute selection methods. We then compare many state-of-the-art feature selection strategies with our XAI-based feature selection methods, showing that most AI models perform better when using the XAI-based approach proposed in this work. By providing novel feature selection techniques and establishing the foundation for several XAIbased strategies, this research aids security analysts in the AI decision-making reasoning of IDS by providing them with a better grasp of critical intrusion traits. Furthermore, we make the source codes available, thus the community may develop additional models on top of our foundational XAI-based feature selection framework.

Network Intrusion Detection Systems (NIDS) are a cornerstone of modern cybersecurity, increasingly leveraging deep learning to achieve high accuracy in identifying malicious network traffic. However, this reliance on data-driven models introduces a critical vulnerability: adversarial attacks. Recent research has demonstrated that imperceptible, crafted perturbations to network packets can cause state-of-the-art NIDS models to misclassify malicious traffic as benign, potentially rendering them useless. This paper provides a comprehensive review and analysis of the burgeoning field of adversarial robustness in NIDS. We first systemize the current threat landscape, categorizing attack strategies-from generative and gradient-based to black-box and query-based methods-and highlighting their practical feasibility in constrained network environments. We then critically evaluate a spectrum of defense mechanisms, including adversarial training, input sanitization, distillation, and architectural enhancements, assessing their effectiveness, computational overhead, and performance trade-offs. A key contribution of this work is an experimental benchmark comparing several prominent defense strategies under a unified evaluation framework against a suite of adaptive attacks. Our findings reveal that while some defenses offer marginal gains, many are brittle under sophisticated threat models, exposing a significant gap between current research and real-world deployability. We conclude by outlining open challenges and charting future research directions, emphasizing the need for intrinsically robust models, realistic evaluation metrics, and the development of defenses that account for the temporal and sequential nature of network traffic.

Computer network security has become a crucial aspect as dependence on network-based services increases. One important mechanism in maintaining network security is the Network Intrusion Detection System (NIDS), which functions to detect suspicious activity or attacks on network traffic. The traditional signature-based approach has limitations in detecting new attacks (zero-day attacks). Therefore, this study proposes the application of Machine Learning and Deep Learning methods to improve network intrusion detection capabilities. The CIC-IDS2017 dataset was used as the data source because it represents various types of modern network attacks. The research stages included data pre-processing, feature selection, model training, and performance evaluation using accuracy, precision, recall, and F1-score metrics. The models used include Random Forest as a representation of Machine Learning and Long Short-Term Memory (LSTM) as a representation of Deep Learning. The results show that the Deep Learning approach is capable of providing better detection performance on complex attacks compared to conventional Machine Learning methods. This research is expected to serve as a reference in the development of adaptive and accurate network intrusion detection systems.

This chapter explores the transformation of Network Intrusion Detection Systems (NIDS) following the evolution of networks from traditional, static infrastructures to programmable entities. Legacy NIDSs are conceived as static, fixed perimeter-based hardware appliances that rely on patterns to detect malicious activities. As cyber threats evolve, these systems become inadequate, unable to keep pace with dynamic, high-speed environments. The rise of Network Function Virtualization (NFV) and Software-Defined Networking (SDN), which made the networks programmable as software, allows for more flexible, adaptive intrusion detection. Using real-time data analytics and machine learning, they enable the rapid identification and mitigation of sophisticated threats. This evolution is crucial in addressing modern cybersecurity challenges, as programmable networks open up to enhanced visibility, scalability, and proactive threat management. Trying to highlight this transition and also providing a practical deployment scenario, this chapter focuses on the innovations that make modern NIDSs more robust by exploiting the evolutionary leap that the network is undergoing.

Abstract In the face of growing and complex network threats, intrusion detection systems are important to detect and mitigate these network threats. Existing research has shown that using a single machine learning classifier or traditional ensemble model for threat detection methods cannot adapt to today's complex network environment. To address the above problems, this paper proposes a novel voting model based on ensemble learning to handle hard-to-classify data such as complex network datasets. This model combines multiple voting mechanisms, and also supports human intervention for more complex data where the classification results may not be highly accurate. The model adopts a voting mechanism among seven base models which includes decision tree, LightGBM, linear discriminant analysis, logistic regression, random forest, gaussian naive bayes, and AdaBoost. The resulting ensemble model has been trained and validated on three popular datasets KDDCup99, UNSW-NB15, CIC-IDS2017 and an additional dataset namely “UC dataset” obtained from University of Cincinnati. We use the popular four metrics of accuracy, precision, recall and f1-score to measure the effectiveness of the model. The results show that the accuracy of the classifiers can be improved to more than 0.99. The model can also be used to effectively improve low-performing classifiers.