• International Journal of Computer Science & Network Security
• /
• v.22 no.3
• /
• pp.155-162
• /
• 2022

Over the last 10 years, there has been rapid growth in the use of Machine Learning (ML) techniques to automate the process of intrusion threat detection at a scale never imagined before. This has prompted researchers, software engineers, and network specialists to rethink the applications of machine ML techniques particularly in the area of cybersecurity. As a result there exists numerous research documentations on the use ML techniques to detect and block cyber-attacks. This article is a systematic review involving the identification of published scholarly articles as found on IEEE Explore and Scopus databases. The articles exclusively related to the use of machine learning in Intrusion Detection Systems (IDS). Methods, concepts, results, and conclusions as found in the texts are analyzed. A description on the process taken in the identification of the research articles included: First, an introduction to the topic which is followed by a methodology section. A table is used to list identified research articles in the form of title, authors, methodology, and key findings.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.11a
• /
• pp.945-948
• /
• 2005

현재 침입탐지시스템(IDS:Intrusion Detection System)은 다양한 평가요소들 - 탐지율, 오탐율, 새로운 공격탐지능력, 안정성 등을 기준으로 평가되고 있고, 이러한 결과는 제품의 보호수준을 결정하거나 한 조직의 정보보호장치로 적합한지를 평가하는 벤치마킹테스트의 방법으로 활용된다. 그러나, 이러한 평가의 결과는 조직의 침입탐지시스템을 구축하고자 하는 네트워크 환경하에서 각각의 침입탐지시스템이 갖는 특성에 따라 상대적인 평가는 가능하나 해당 조직의 네트워크 인프라와 위협요소, 취약점을 고려했을 때 보다 최적의 것이 무엇인지를 평가하는 방법으로는 한계가 있다. 그러므로, 본 연구논문에서는 이러한 한계를 극복하기 위한 방법으로서 조직의 정보보호 위험분석에서 도출된 해당 네트워크 환경의 자산, 위협, 취약성의 결과인 위험과 위험수준을 IDS 평가에 반영하여 조직의 환경하에 보다 적합한 침입탐지시스템 선정이 가능한 평가방법을 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2213-2216
• /
• 2003

단일 호스트 환경에 특화되어 설계되어온 기존 침입탐지 시스템(Intrusion Detection System: IDS)은 침입 시 도메인의 보호만을 그 목적으로 하는 수동적인 성격으로써, 새로운 공격 기법에 대한 탐지 및 대응, 그리고 보다 그 규모가 큰 네트워크로의 확장 면에서 구조적인 결함을 가지고 있다. 이러한 IDS의 구조적 문제점의 해결방안으로 액티브 네트워크 기반의 IDS 에 관한 연구가 진행되고 있다. 액티브 네트워크(Active network)란 패킷 스위칭 네트워크 상에 프로그램 가능한 라우터 등인 액티브 노드들을 배치하고, 사용자의 요구에 상응하는 적절한 연산을 위한 데이터와 프로그램으로 구성된 스마트 패킷(smart packet)에 대하여 수행 가능하게 하는 접근 방법이다. 본 논문에서는 이를 기반으로 자율적이며 지능적인 에이전트로 구성된 멀티 에이전트 기술을 액티브 노드에 적용함으로써 기존 IDS 보안메커니즘에서 보다 러 진보된 능동적이고 적극적인 대응을 위한 보안 메커니즘을 제공하여 네트워크 공격에 의한 피해 최소화와 신속한 대응이 가능한 멀티 에이전트 기반 공격 대응 메커니즘을 제시하고, 이를 적용 가능한 액티브 네트워크 기반 프레임 설계를 제안한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2011.06d
• /
• pp.115-117
• /
• 2011

Intrusion detection systems (IDS) are supposed to be an efficient safety measure against inside attacks. In purely distributed IDS approach, IDS agent is installed in every node. It checks abnormal behavior of neighboring nodes locally. It collects the data that it receives from nodes in its radio range. Sensor nodes audit that data and generate alerts for abnormal activity. Here, there are two ways of taking decision. First, it can take decision individually and second, it can communicate with its neighbor to find the status of the claimed compromised nodes. In this paper, we propose a collaborative decision making scheme for purely distributed detection system. The proposed scheme is light weight compared to consensus based validation methodology. It provides a better scheme to find intrusions by interacting with other nodes.

• Convergence Security Journal
• /
• v.4 no.2
• /
• pp.1-7
• /
• 2004

The growth of incidents on the Internet has reflected growth of the internet itself and growth of the computing Power. while in Previous years, external attacks tended to originate from those interested trend in exploring the Internet for its own sake and testing their skills, there is an increasing trend towards intrusions motivated by financial, Political, and military objectives. so, attacks on the nation's computer infrastructures are becoming an increasingly serious problem. Even though the problem is ubiquitious, government agencies are particularly appealing targets and they tend to be more willing to reveal such events than commercial organizations. The threat of damage made necessity of security's recognition, as a result, many researches have been carried out into security of system actively. Intrusion Detection technology is detection of intrusion using audit data differently from using traditional simple filtering and informs manager of it. It has security manager of system deal with the intrusion more quickly. but, cause current environment of Internet manager can't doing response Intrusion alert immediately That's why IPS needed. IPS can response automatically the intrusion alert. so, manager is more comfortable and can response quickly.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2006.06a
• /
• pp.219-222
• /
• 2006

In this paper an intrusion detection system technique of wireless Ad Hoc network is explained and the advantage of making them work in IEEE 802.15.4/ZigBee wireless standard is also discussed. The methodology that is mentioned here is intrusion detection architecture based on a local intrusion database [1]. An ad hoc network is a collection of nodes that is connected through a wireless medium forming rapidly changing topologies. Due to increased connectivity (especially on the Internet), and the vast spectrum of financial possibilities that are opening up, more and more systems are subject to attack by intruders. An ideal IDS should able to detect an anomaly caused by the intruders quickly so that the misbehaving node/nodes can be identified and appropriate actions (e.g. punish or avoid misbehaving nodes) can be taken so that further damage to the network is minimized

• The KIPS Transactions:PartC
• /
• v.10C no.5
• /
• pp.525-532
• /
• 2003

This paper describes intrusion detection rule management using mobile agents. Intrusion detection can be divided into anomaly detection and misuse detection. Misuse detection is best suited for reliably detecting known use patterns. Misuse detection systems can detect many or all known attack patterns, but they are of little use for as yet unknown attack methods. Therefore, the introduction of mobile agents to provide computational security by constantly moving around the Internet and propagating rules is presented as a solution to misuse detection. This work presents a new approach for detecting intrusions, in which mobile agent mechanisms are used for security rules propagation. To evaluate the proposed approach, we compared the workload data between a rules propagation method using a mobile agent and a conventional method. Also, we simulated a rules management using NS-2 (Network Simulator) with respect to time.

• International Journal of Computer Science & Network Security
• /
• v.23 no.9
• /
• pp.55-64
• /
• 2023

The Internet of Things (IoT) is the combination of the internet and various sensing devices. IoT security has increasingly attracted extensive attention. However, significant losses appears due to malicious attacks. Therefore, intrusion detection, which detects malicious attacks and their behaviors in IoT devices plays a crucial role in IoT security. The intrusion detection system, namely IDS should be executed efficiently by conducting classification and efficient feature extraction techniques. To effectively perform Intrusion detection in IoT applications, a novel method based on a Conventional Neural Network (CNN) for classification and an improved Genetic Algorithm (GA) for extraction is proposed and implemented. Existing issues like failing to detect the few attacks from smaller samples are focused, and hence the proposed novel CNN is applied to detect almost all attacks from small to large samples. For that purpose, the feature selection is essential. Thus, the genetic algorithm is improved to identify the best fitness values to perform accurate feature selection. To evaluate the performance, the NSL-KDDCUP dataset is used, and two datasets such as KDDTEST²¹ and KDDTEST⁺ are chosen. The performance and results are compared and analyzed with other existing models. The experimental results show that the proposed algorithm has superior intrusion detection rates to existing models, where the accuracy and true positive rate improve and the false positive rate decrease. In addition, the proposed algorithm indicates better performance on KDDTEST⁺ than KDDTEST²¹ because there are few attacks from minor samples in KDDTEST⁺. Therefore, the results demonstrate that the novel proposed CNN with the improved GA can identify almost every intrusion.

• Journal of the Korea Computer Industry Society
• /
• v.5 no.8
• /
• pp.781-790
• /
• 2004

This paper describes intrusion detection rule mangement using mobile agents. Intrusion detection can be divided into anomaly detection and misuse detection. Misuse detection is best suited for reliably detecting known use patterns. Misuse detection systems can detect many or all known attack patterns, but they are of little use for as yet unknown attack methods. Therefore, the introduction of mobile agents to provide computational security by constantly moving around the Internet and propagating rules is presented as a solution to misuse detection. This work presents a new approach for detecting intrusions, in which mobile agent mechanisms are used for security rules propagation. To evaluate the proposed appraoch, we compared the workload data between a rules propagation method using a mobile agent and a conventional method. Also, we simulated a rules management using NS-2(Network Simulator) with respect to time.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.10
• /
• pp.5023-5038
• /
• 2017

Big data is an emerging technology which deals with wide range of data sets with sizes beyond the ability to work with software tools which is commonly used for processing of data. When we consider a huge network, we have to process a large amount of network information generated, which consists of both normal and abnormal activity logs in large volume of multi-dimensional data. Intrusion Detection System (IDS) is required to monitor the network and to detect the malicious nodes and activities in the network. Massive amount of data makes it difficult to detect threats and attacks. Sequential Pattern mining may be used to identify the patterns of malicious activities which have been an emerging popular trend due to the consideration of quantities, profits and time orders of item. Here we propose a sequential pattern mining algorithm with fuzzy logic feature selection and fuzzy weighted support for huge volumes of network logs to be implemented in Apache Hadoop YARN, which solves the problem of speed and time constraints. Fuzzy logic feature selection selects important features from the feature set. Fuzzy weighted supports provide weights to the inputs and avoid multiple scans. In our simulation we use the attack log from NS-2 MANET environment and compare the proposed algorithm with the state-of-the-art sequential Pattern Mining algorithm, SPADE and Support Vector Machine with Hadoop environment.