An efficient network behavior anomaly detection using a hybrid DBN-LSTM network

Optimization of predictive performance of intrusion detection system using hybrid ensemble model for secure systems

Network intrusion is one of the main threats to organizational networks and systems. Its timely detection is a profound challenge for the security of networks and systems. The situation is even more challenging for small and medium enterprises (SMEs) of developing countries where limited resources and investment in deploying foreign security controls and development of indigenous security solutions are big hurdles. A robust, yet cost-effective network intrusion detection system is required to secure traditional and Internet of Things (IoT) networks to confront such escalating security challenges in SMEs. In the present research, a novel hybrid ensemble model using random forest-recursive feature elimination (RF-RFE) method is proposed to increase the predictive performance of intrusion detection system (IDS). Compared to the deep learning paradigm, the proposed machine learning ensemble method could yield the state-of-the-art results with lower computational cost and less training time. The evaluation of the proposed ensemble machine leaning model shows 99%, 98.53% and 99.9% overall accuracy for NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets, respectively. The results show that the proposed ensemble method successfully optimizes the performance of intrusion detection systems. The outcome of the research is significant and contributes to the performance efficiency of intrusion detection systems and developing secure systems and applications.

Dual Auto-Encoder GAN-Based Anomaly Detection for Industrial Control System

As a core tool, anomaly detection based on a generative adversarial network (GAN) is showing its powerful potential in protecting the safe and stable operation of industrial control systems (ICS) under the Internet of Things (IoT). However, due to the long-tailed distribution of operating data in ICS, existing GAN-based anomaly detection models are prone to misjudging an unseen marginal sample as an outlier. Moreover, it is difficult to collect abnormal samples from ICS. To solve these challenges, a dual auto-encoder GAN-based anomaly detection model is proposed for the industrial control system, simply called the DAGAN model, to achieve an accurate and efficient anomaly detection without any abnormal sample. First, an “encoder–decoder–encoder” architecture is used to build a dual GAN model for learning the latent data distribution without any anomalous sample. Then, a parameter-free dynamic strategy is proposed to robustly and accurately learn the marginal distribution of the training data through dynamic interaction between two GANs. Finally, based on the learned normal distribution and marginal distribution, an optimized anomaly score is used to measure whether a sample is an outlier, thereby reducing the probability of a marginal sample being misjudged. Extensive experiments on multiple datasets demonstrate the advantages of our DAGAN model.

Oversampling by genetic algorithm and k-nearest neighbors for network intrusion problem

A class imbalance problem is a problem in which the number of majority class and minority class varies greatly. In this article, we propose an oversampling method using GA and k-Nearest Neighbors (kNN) to deal with a network intrusion, a class imbalance problem. We use GA as the main algorithm and use a kNN as its fitness function. We compare the proposed method with a very popular oversampling technique which is a SMOTE family. The experimental results show that the proposed method provides better Accuracy, Precision, and F-measure values than a SMOTE family in almost all datasets with almost all classifiers. Moreover, in some datasets with some classifiers, the proposed method also gives a better Recall value than a SMOTE family as well. This is because the proposed method can generate new intruders in a more independent area than a SMOTE family.