Earticle

The development of the Internet of Things (IoT) has created new issues in network security due to the diverse resource-constrained nature of IoT devices and the massive volume of generated heterogeneous data. One of the most important procedures in network security is intrusion detection system (IDS). The goal of intrusion detection is to locate and stop harmful activity within the network. Machine learning methods are employed to create precise IDS models. This article provides a practical overview of tree-based Machine Learning (ML) algorithms for intrusion detection. It delves into the application of Random Forest (RF), Decision Tree (DT), AdaBoost, and the J48 classifier in the context of network traffic security. The NSL-KDD data set is used to evaluate these approaches. According to experimental results, the Random Forest Classifier outperforms the other techniques.

기존 침입 탐지 연구가 주로 정상/비정상 또는 공격 유형 분류에 머무르는 한계를 보완하고자, 사이버 침해사고의 보안 통 제 실패 관점 심층 원인 후보를 자동으로 추론하는 인공지능 기반 모델을 제안한다. 이를 위해 공개 네트워크 침입 탐지 데이 터셋인 CSE-CIC-IDS2018을 활용하여, 침해사고를 입력 검증 실패, 인증·세션 관리 취약, 접근통제 실패, 보안 구성 오류, 트 래픽·레이트 제어 미흡 등 10개 원인 카테고리(C01～C10)로 재구성한 심층 원인 분류 체계를 설계하고, 공격 유형과 도메인 지식을 이용한 규칙 기반 매핑을 통해 각 플로우에 가설적(proxy) 멀티라벨(C01～C10)을 부여하였다. 이후 전처리 및 특징 선 택을 거쳐 로지스틱 회귀, 랜덤 포레스트, 그래디언트 부스팅, 다층 퍼셉트론(MLP) 기반 멀티라벨 분류 모델을 학습·평가한 결과, 제안 MLP 모델은 C01～C10 원인 카테고리 전반에서 micro/macro F1-score와 Hamming loss 지표 기준으로 기존 머신 러닝 베이스라인 대비 우수한 성능을 보였으며, 각 침해사고에 대해 2～3개의 보안 통제 실패 요인을 동시에 제시할 수 있었 다. 이를 통해 동일한 데이터에서 “DoS 공격 여부”와 같은 단일 공격 유형 정보뿐 아니라, “트래픽·레이트 제어 미흡, 플랫폼· 환경 설정 취약”과 같이 후속 조사와 재발 방지에 직결되는 심층 원인 후보 정보를 자동으로 제공하는 ‘원인 추천 엔진’으로 활용 가능함을 보였으며, 보안 담당자의 사고 분석 및 정책·설정 개선 의사결정을 지원하는 설명 가능한 보안 분석 도구로서 의 잠재력을 확인하였다.

Traditional intrusion detection mainly classifies traffic as normal or malicious, or identifies attack types, offering limited insight into why incidents occur. This study proposes an AI-based approach for automatic deep root cause analysis of cyber incidents. Using the CSE-CIC-IDS2018 dataset, we map each flow to up to ten root cause categories (C01–C10), such as input validation failure, authentication/session weakness, and security misconfiguration, and train multi-label classifiers, including an MLP model. Experiments show that the proposed MLP achieves competitive performance (micro F1 ≈ 0.94) while providing multiple plausible control failures per incident, supporting more actionable and explainable incident response.

네트워크 공격을 탐지하기 위하여 기계학습을 이용한 다양한 연구가 최근 급격히 증가하고 있다. 이러한 기계학 습 방법은 많은 데이터에 의존적이며 연구를 위해 다양한 실험 데이터가 공개되어 사용되고 있다. 하지만 실험 데이터 및 실제 환경에서 수집되는 데이터는 class간의 수량이 불균형하다는 문제점을 가지고 있다. 본 연구에서는 기계 학습 을 이용한 침입탐지시스템의 한계점 중 학습데이터의 class간 불균형으로 인한 분류 성능 저하를 해결하기 위한 방법을 제안한다. 이를 위해 네트워크 트래픽 데이터를 처리하고 seqGAN를 이용하여 부족한 데이터를 생성하였다. 제안된 방법은 NSL-KDD, UNSW-NB15 데이터 셋을 대상으로 Text-CNN을 이용하여 분류하는 테스트를 실행한 결과 정밀 도가 향상되는 것을 확인할 수 있었다.

Recently, various approaches to detect network attacks using machine learning have been studied and are being applied to detect new attacks and to increase precision. However, the machine learning method is dependent on feature extraction and takes a long time and complexity. It also has limitation of performace due to learning data imbalance. In this study, we propose a method to solve the degradation of classification performance due to imbalance of learning data among the limit points of detection system. To do this, we generate data using Generative Adversarial Networks (GANs) and propose a classification method using Convolutional Neural Networks (CNNs). Through this approach, we can confirm that the accuracy is improved when applied to the NSL-KDD and UNSW-NB15 datasets.

본 논문에서는 단일 클래스만을 학습하여 네트워크 침입탐지 시스템 상에서 새로운 비정상 행위를 탐지하는 것을 목표로 한다. 분류 성능 평가를 위해 KDD CUP 1999 데이터셋을 사용한다. 단일 클래스 분류는 정상 클래스만을 학습하여 공격 클래스를 분류해내는 비지도 학습 방법 중 하나이다. 비지도 학습의 경우에는 학습에 네거티브 인스턴스를 사용하지 않기 때문에 상대적으로 높은 분류 효율을 내는 것이 어렵다. 하지만, 비지도 학습은 라벨이 없는 데이터를 분류하는데 적합 한 장점이 있다. 본 연구에서는 서포트벡터머신 기반의 단일 클래스 분류기와 밀도 추정 기반의 단일 클래스 분류기를 사용 한 실험을 통해 기존에 없던 새로운 공격에 대한 탐지를 한다. 밀도 추정 기반의 분류기를 사용한 실험이 상대적으로 더 좋은 성능을 보였고, 신규 공격에 대해 낮은 FPR을 유지하면서도 약 96%의 탐지율을 보인다.

In this study, we try to detect anomalies on the network intrusion detection system by learning only one class. We use KDD CUP 1999 dataset, an intrusion detection dataset, which is used to evaluate classification performance. One class classification is one of unsupervised learning methods that classifies attack class by learning only normal class. When using unsupervised learning, it difficult to achieve relatively high classification efficiency because it does not use negative instances for learning. However, unsupervised learning has the advantage for classifying unlabeled data. In this study, we use one class classifiers based on support vector machines and density estimation to detect new unknown attacks. The test using the classifier based on density estimation has shown relatively better performance and has a detection rate of about 96% while maintaining a low FPR for the new attacks.

데이터 전처리 기법 중 하나인 특징 선택은 대규모 데이터셋을 다루는 다양한 응용분야에서 주요 연구 분야 중 하나로 각광받고 있다. 특징 선택은 패턴 인식, 기계학습 및 데이터 마이닝에서 사용됐고, 최근에는 텍스트 분류, 이미지 검색, 침입 탐지 및 게놈 분석과 같은 다양한 분야에 널리 적용되고 있다. 제안 방법은 메타 휴리스틱 알고리즘 중의 하나인 유전 알고리즘을 기반으로 한다. 특징 부분 집합을 찾는 방법은 크게 필터(filter) 방법과 래퍼(wrapper) 방법이 있는데, 본 연구에서는 최적의 특징 부분 집합을 찾기 위해 실제 분류기를 사용한 평가를 하는 래퍼 방법을 사용한다. 실험에 사용한 훈련 데이터셋은 클래스 불균형이 심하여 희소클래스에 대한 분류 성능을 높이기 어렵다. SMOTE 기법을 적용한 훈련 데이터셋을 사용하여 특징 선택을 하고 다양한 기계학습 알고리즘을 사용하여 선택한 특징들의 성능을 평가한다.

Feature selection, one of data preprocessing techniques, is one of major research areas in many applications dealing with large dataset. It has been used in pattern recognition, machine learning and data mining, and is now widely applied in a variety of fields such as text classification, image retrieval, intrusion detection and genome analysis. The proposed method is based on a genetic algorithm which is one of meta-heuristic algorithms. There are two methods of finding feature subsets: a filter method and a wrapper method. In this study, we use a wrapper method, which evaluates feature subsets using a real classifier, to find an optimal feature subset. The training dataset used in the experiment has a severe class imbalance and it is difficult to improve classification performance for rare classes. After preprocessing the training dataset with SMOTE, we select features and evaluate them with various machine learning algorithms.

본 논문은 최근 융합 기술을 토대로 활발히 연구되는 스마트 그리드 환경하에서의 외부의 불법적인 접근에 대한 보안 모듈을 제안 하고자 한다. 스마트 그리는 AMI 시스템에서 원격 검침등의 여러 서비스를 적용 하고 있다 때문에 네트워크 통신망에 존재하던 취약한 위험 요소를 그대로 나타내고 있다. 본 논문에서는 홈 네트워크 기반하에 서 스마트 미터기를 비롯한 훔 네트워크 장비에 속하는 홈 네트워크 망에서의 비정상적인 서비스 요청을 탐지 차단 하고 사용자의 접근을 인증 실행하는 보다 안전한 보안 모듈을 제안 연구 하였다. 향후 제안된 보안 모듈을 보다 경량화 하여 하드웨어로 구현 개발 하여 다양한 형태의 활용에 대한 연구가 요구된다.

The thesis suggests a secure module that gain illegal access from external, in the smart grid environment which is actively studied based on the recent convergence technology. Smart grid applies many services such as the remote reading of meter in AMI system. So it has the weakness of the of the existing network as it is. Hence, the thesis studied more securable module that not only detect and cut off the abnormal service request but also confirm and execute the normal service request by the normal user which belongs to home network devices as well as smart meters based on the home network. The thesis suggests the diversifiable utilization in variety by making the proposed secure module light.

Intrusion detection acts as a vital function in providing information security, and additionally the key technology is to precisely classify diverse attacks. Intrusion detection system (IDS) is identified as an important security issue within the cloud network environment. In this paper, IDS is given based on an innovative optimized custom RC-NN (Recurrent Convolutional Neural Network) which is proposed for intrusion detection along with the Ant Lion optimization algorithm. By this method, CNN (Convolutional Neural Network) is made hybrid with LSTM (Long Short Term Memory). Thus, all the attacks identified with the network layer of cloud are classified efficiently. The experimental results shown below describe the presentation of the IDS classification model with high accuracy, thus improving the detection rate or error rate. The optimized custom RC-NN-IDS model thus achieved an improved classification accuracy of 94% and also a decreased error rate of 0.0012. Additionally true positive rate, true negative rate and precision are considered as performance metrics. The proposed approach is evaluated using the DARPA IDS evaluation Data Sets and CSE-CIC-IDS2018 dataset and is compared with some existing approaches.

This paper proposes a new intrusion detection system (IDS) based on a combination of a multilayer perceptron (MLP) network, and artificial bee colony (ABC) and fuzzy clustering algorithms. Normal and abnormal network traffic packets are identified by the MLP, while the MLP training is done by the ABC algorithm through optimizing the values of linkage weights and biases. The CloudSim simulator and NSL-KDD dataset are used to verify the proposed method. Mean absolute error (MAE), root mean square error (RMSE), and the kappa statistic are considered as evaluation criteria. The obtained results have indicated the superiority of the proposed method in comparison with state-of-the-art methods.

This paper presents a novel approach to detection of malicious network traffic using artificial neural networks suitable for use in deep packet inspection based intrusion detection systems. Experimental results using a range of typical benign network traffic data (images, dynamic link library files, and a selection of other miscellaneous files such as logs, music files, and word processing documents) and malicious shell code files sourced from the online exploit and vulnerability repository exploitdb [1], have shown that the proposed artificial neural network architecture is able to distinguish between benign and malicious network traffic accurately. The proposed artificial neural network architecture obtains an average accuracy of 98%, an average area under the receiver operator characteristic curve of 0.98, and an average false positive rate of less than 2% in repeated 10-fold cross-validation. This shows that the proposed classification technique is robust, accurate, and precise. The novel approach to malicious network traffic detection proposed in this paper has the potential to significantly enhance the utility of intrusion detection systems applied to both conventional network traffic analysis and network traffic analysis for cyber?physical systems such as smart-grids.

With the increasing sophistication of cyber threats, traditional Intrusion Detection Systems (IDS) often fail to adapt to evolving attack patterns, leading to high false positive rates and inadequate detection of zero-day attacks. This study proposes the Deep Q-Learning Intrusion Detection System (DQ-IDS), a novel reinforcement learning (RL)-based approach designed to dynamically learn network attack behaviors and continuously enhance detection performance. Unlike conventional machine learning (ML) and deep learning (DL)-based IDS models that depend on static, pre-trained classifiers, DQ-IDS employs Deep Q-Networks (DQN) with experience replay and adaptive ε-greedy exploration to autonomously classify benign and malicious network traffic. The integration of experience replay mitigates catastrophic forgetting, while adaptive exploration ensures an optimal trade-off between learning efficiency and threat detection. A reward-driven training mechanism reinforces correct classifications and penalizes errors, thereby reducing both false positive and false negative rates. Extensive empirical evaluations on real-world network datasets demonstrate that DQ-IDS achieves a detection accuracy of 97.18%, significantly outperforming conventional IDS solutions in both attack detection and computational efficiency. This work introduces a paradigm shift toward adaptive, self-learning cybersecurity systems capable of real-time, robust threat mitigation in dynamic network environments.

Internet of Things (IoT) is suffered from different types of attacks due to vulnerability present in devices. Due to many IoT network traffic features, the machine learning models take time to detect attacks. This paper proposes a feature selection for intrusion detection systems (IDSs) using Information Gain (IG) and Gain Ratio (GR) with the ranked top 50% features for the detection of DoS and DDoS attacks. The proposed system obtains feature subsets using insertion and union operations on subsets obtained by the ranked top 50% IG and GR features. The proposed method is evaluated and validated on IoT-BoT and KDD Cup 1999 datasets, respectively, with a JRipclassifier. The system provides higher performance than the original feature set and traditional IDSs on IoT-BoT and KDD Cup 1999 datasets using 16 and 19 features, respectively.

This paper proposes an FPGA-based network intrusion detection system for the IEC 61850-based industrial network that is specially designed for substation automation. The proposed system uses the Shift-And algorithm for detecting malicious network packets within IEC 61850 messages. To implement a complex rule matching module with a limited memory size of FPGA, a specially designed rule matching module was proposed in this paper. For feasibility evaluation, a prototype with 265 regular expression matching modules was implemented using Xilinx Zynq-7030 FPGA and its performance is presented in this paper.

The emerging Internet of Medical Things (IoMT) architecture enables real-time processing and monitoring of medical information. Its growing applications expose it to sophisticated cyber threats. Intrusion Detection Systems (IDS) have therefore become indispensable in ensuring confidentiality, integrity, and regulatory compliance. Existing surveys address the security issues, but they lack dataset analysis and integration of emerging approaches. This review presents a systematic review that classifies IoMT-IDSs across deployment strategies, response mechanisms, and evaluation metrics. We develop a multi-dimensional taxonomy that highlights the gaps and outlines a roadmap with federated IDS, blockchain validation, and explainable AI for secure healthcare.

As machine learning technology advances, data security becomes increasingly important. In this study, we propose an intrusion detection mechanism based on federated learning (FL) that updates only the learning weights to minimize the risk of information leakage. Considering the limited resources of industrial Internet of Things (IIoT) nodes, we propose a learning method based on data pruning. The proposed FL-based intrusion detection model was found to be more secure than the centralized model in terms of the data leakage rate. Data pruning technology reduced the memory usage by 1.4 times while maintaining 97.7 % accuracy. The proposed method detects attacks in industrial sites where large-scale IIoT nodes are installed efficiently, and protects industrial secrets and personal information effectively.

One of the latest emerging technologies is artificial intelligence, which makes the machine mimic human behaviour. The most important component used to detect cyber attacks or malicious activities is the intrusion detection system (IDS). Artificial intelligence plays a vital role in detecting intrusions and widely considered as the better way in adapting and building IDS. In modern days, neural network algorithms are emerging as a new artificial intelligence technique that can be applied to real-time problems. The proposed system is to detect a classification of botnet attack which poses a serious threat to financial sectors and banking services. The proposed system is created by applying artificial intelligence on a realistic cyber defence dataset (CSE-CIC-IDS2018), the latest IDS Dataset in 2018 by Canadian Institute for Cybersecurity (CIC) on AWS (Amazon Web Services). The proposed system of Artificial Neural Networks provides an outstanding performance of Accuracy score is 99.97% and an average area under ROC(Receiver Operator Characteristic) curve is 0.999 and an average False Positive rate is a mere value of 0.03. The proposed system of Artificial Intelligence-based Intrusion detection of botnet attack classification is powerful, more accurate and precise. The novel proposed system can be applied to conventional network traffic analysis, cyber-physical system traffic analysis and also can be applied to the real-time network traffic data analysis.

Due to the sensitivity of the information required to detect network intrusions efficiently, collecting huge amounts of network transactions is inevitable and the volume and details of network transactions available in recent years has been high. The meta-heuristic anomaly based assessment is vital in an exploratory analysis of intrusion related network transaction data. In order to forecast and deliver predictions about intrusion possibility from the available details of the attributes involved in network transaction. In this regard, a meta-heuristic assessment model called the feature correlation analysis and association impact scale is explored to estimate the degree of intrusion scope threshold from the optimal features of network transaction data available for training. With the motivation gained from the model called “network intrusion detection by feature association impact scale” that was explored in our earlier work, a novel and improved meta-heuristic assessment strategy for intrusion prediction is derived. In this strategy, linear canonical correlation for feature optimization is used and feature association impact scale is explored from the selected optimal features. The experimental result indicating that the feature correlation is has a significant impact towards minimizing the computational and time complexity of measuring the feature association impact scale.

Zero-day attacks threaten IoT security as signature-based detection fails against novel exploits. This paper proposes a hybrid Intrusion Detection System integrating unsupervised anomaly detection, non-parametric Siamese-based cross-dataset dissimilarity filtering, and Proximal Policy Optimization (PPO)-based adaptive defense. Unsupervised models isolate anomalous traffic, Siamese-based correlation extracts structurally rare zero-day candidates, and the PPO agent learns optimal defense policies via environmental feedback. Evaluations on CIC-IoT-2023 and CIC-BCCC-NRC-TabularIoTAttacks-2024 demonstrate 99.28% training accuracy, 99.07% unseen attack accuracy, and 93.94% zero-day detection rate with 0.50 ms latency and 2.21% false-positive rate, providing a scalable, proactive, self-learning defense architecture for autonomous IoT cybersecurity.

This paper presents a systematic review of deep learning (DL) techniques for Network-based Intrusion Detection Systems (NIDS) based on Preferred Reporting Items for Systematic Reviews and Meta-Analyses: (PRISMA2020) guidelines. It explores recent advancements in data preparation, DL architectures, and performance evaluation metrics for NIDS. The review provides insights into various datasets and tools used in the field, highlighting the effectiveness of DL in improving NIDS performance. Additionally, it discusses the applications of NIDS across different industries and identifies emerging research trends, offering a comprehensive resource for researchers and practitioners in cybersecurity.

With the advances and growth of various wireless technologies, it is imperative to implement robust Intrusion Detection Systems (IDS). This paper proposes the implementation of Deep Gated Recurrent Unit (DGRU) Based classifier as well as a wrapper-based feature extraction algorithm for Wireless IDS. We assess the performance of the DRGU IDS using the NSL-KDD benchmark dataset. Furthermore, we compare our framework to several popular algorithms including Artificial Neural Networks, Deep Long?Short Term Memory, Random Forest, Naive Bayes and Feed Forward Deep Neural Networks. The experimental outcomes demonstrate that the DGRU IDS displays a significant increase in performance over existing methods.