Intrusion Detection Systems in Internet of Things and Mobile Ad-Hoc Networks

Internet of Things (IoT) devices work mainly in wireless mediums; requiring different Intrusion Detection System (IDS) kind of solutions to leverage 802.11 header information for intrusion detection. Wireless-specific traffic features with high information gain are primarily found in data link layers rather than application layers in wired networks. This survey investigates some of the complexities and challenges in deploying wireless IDS in terms of data collection methods, IDS techniques, IDS placement strategies, and traffic data analysis techniques. This paper’s main finding highlights the lack of available network traces for training modern machine-learning models against IoT specific intrusions. Specifically, the Knowledge Discovery in Databases (KDD) Cup dataset is reviewed to highlight the design challenges of wireless intrusion detection based on current data attributes and proposed several guidelines to future-proof following traffic capture methods in the wireless network (WN). The paper starts with a review of various intrusion detection techniques, data collection methods and placement methods. The main goal of this paper is to study the design challenges of deploying intrusion detection system in a wireless environment. Intrusion detection system deployment in a wireless environment is not as straightforward as in the wired network environment due to the architectural complexities. So this paper reviews the traditional wired intrusion detection deployment methods and discusses how these techniques could be adopted into the wireless environment and also highlights the design challenges in the wireless environment. The main wireless environments to look into would be Wireless Sensor Networks (WSN), Mobile Ad Hoc Networks (MANET) and IoT as this are the future trends and a lot of attacks have been targeted into these networks. So it is very crucial to design an IDS specifically to target on the wireless networks.     

分级的Ad Hoc网络入侵检测系统改进

随着无线网络的快速发展和移动计算应用的快速增加,移动无线网络安全问题愈加突出.入侵检测作为保证网络安全的一种有效手段已经从保护固定有线网络扩展到移动无线网络.作为无线移动网络众多实现方式之一的移动Ad Hoc网络分为平面和分级两种结构.由于其与有线网络存在很大差别,现有针对有线网络开发的入侵检测系统很难适用于移动Ad Hoc网络.本文在描述入侵检测相关技术的基础上改进了分级的AdHoc网络入侵检测系统体系结构,并给出了该系统的分簇算法,使之更好地应用于分级的Ad Hoc网络.     

An intrusion detection and prevention system in cloud computing: A systematic review

The distributed and open structure of cloud computing and services becomes an attractive target for potential cyber-attacks by intruders. The traditional Intrusion Detection and Prevention Systems (IDPS) are largely inefficient to be deployed in cloud computing environments due to their openness and specific essence. This paper surveys, explores and informs researchers about the latest developed IDPSs and alarm management techniques by providing a comprehensive taxonomy and investigating possible solutions to detect and prevent intrusions in cloud computing systems. Considering the desired characteristics of IDPS and cloud computing systems, a list of germane requirements is identified and four concepts of autonomic computing self-management, ontology, risk management, and fuzzy theory are leveraged to satisfy these requirements.     

The use of computational intelligence in intrusion detection systems: A review

Intrusion detection based upon computational intelligence is currently attracting considerable interest from the research community. Characteristics of computational intelligence (CI) systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information, fit the requirements of building a good intrusion detection model. Here we want to provide an overview of the research progress in applying CI methods to the problem of intrusion detection. The scope of this review will encompass core methods of CI, including artificial neural networks, fuzzy systems, evolutionary computation, artificial immune systems, swarm intelligence, and soft computing. The research contributions in each field are systematically summarized and compared, allowing us to clearly define existing research challenges, and to highlight promising new research directions. The findings of this review should provide useful insights into the current IDS literature and be a good source for anyone who is interested in the application of CI approaches to IDSs or related fields.     

802．11i安全架构下无线入侵检测系统研究

近年来,无线局域网的使用日益广泛,然而,由于无线网络的天然局限,无线连接存在着许多安全缺陷。讨论了主要的无线攻击和802．11i的安全性能。尽管802．11i提升了无线网络安全性,仍然存在一些安全缺陷。无线入侵检测系统有助于保护无线网络的安全。可以使用像Snort—Wireless这样的开源入侵检测工具保护无线网络的安全。     

An Optimum-Path Forest framework for intrusion detection in computer networks

Intrusion detection systems that make use of artificial intelligence techniques in order to improve effectiveness have been actively pursued in the last decade. However, their complexity to learn new attacks has become very expensive, making them inviable for a real time retraining. In order to overcome such limitations, we have introduced a new pattern recognition technique called optimum-path forest (OPF) to this task. Our proposal is composed of three main contributions: to apply OPF for intrusion detection, to identify redundancy in some public datasets and also to perform feature selection over them. The experiments have been carried out on three datasets aiming to compare OPF against Support Vector Machines, Self Organizing Maps and a Bayesian classifier. We have showed that OPF has been the fastest classifier and the always one with the top results. Thus, it can be a suitable tool to detect intrusions on computer networks, as well as to allow the algorithm to learn new attacks faster than other techniques.     

Intrusion detection by machine learning: A review

The popularity of using Internet contains some risks of network attacks. Intrusion detection is one major research problem in network security, whose aim is to identify unusual access or attacks to secure internal networks. In literature, intrusion detection systems have been approached by various machine learning techniques. However, there is no a review paper to examine and understand the current status of using machine learning techniques to solve the intrusion detection problems. This chapter reviews 55 related studies in the period between 2000 and 2007 focusing on developing single, hybrid, and ensemble classifiers. Related studies are compared by their classifier design, datasets used, and other experimental setups. Current achievements and limitations in developing intrusion detection systems by machine learning are present and discussed. A number of future research directions are also provided.     

Artificial immune systems for the detection of credit card fraud: an architecture,prototype and preliminary results

Some biological phenomena offer clues to solving real‐life, complex problems. Researchers have been studying techniques such as neural networks and genetic algorithms for computational intelligence and their applications to such complex problems. The problem of security management is one of the major concerns in the development of eBusiness services and networks. Recent incidents have shown that the perpetrators of cybercrimes are using increasingly sophisticated methods. Hence, it is necessary to investigate non‐traditional mechanisms, such as biological techniques, to manage the security of evolving eBusiness networks and services. Towards this end, this paper investigates the use of an Artificial Immune System (AIS). The AIS emulates the mechanism of human immune systems that save human bodies from complex natural biological attacks. The paper discusses the use of AIS on one aspect of security management, viz. the detection of credit card fraud. The solution is illustrated with a case study on the management of frauds in credit card transactions, although this technique may be used in a range of security management applications in eBusiness.     

A novel intrusion detection framework for wireless sensor networks

Vehicle cloud is a new idea that uses the benefits of wireless sensor networks (WSNs) and the concept of cloud computing to provide better services to the community. It is important to secure a sensor network to achieve better performance of the vehicle cloud. Wireless sensor networks are a soft target for intruders or adversaries to launch lethal attacks in its present configuration. In this paper, a novel intrusion detection framework is proposed for securing wireless sensor networks from routing attacks. The proposed system works in a distributed environment to detect intrusions by collaborating with the neighboring nodes. It works in two modes: online prevention allows safeguarding from those abnormal nodes that are already declared as malicious while offline detection finds those nodes that are being compromised by an adversary during the next epoch of time. Simulation results show that the proposed specification-based detection scheme performs extremely well and achieves high intrusion detection rate and low false positive rate.     

ContractGuard：面向以太坊区块链智能合约的入侵检测系统

以太坊智能合约本质上是一种在网络上由相互间没有信任关系的节点共同执行的已被双方认证程序。目前,大量的智能合约被用于管理数字资产,使智能合约成为黑客的重要攻击对象。常见的攻击方法是通过利用智能合约的漏洞来实现特定操作的入侵攻击。ContractGuard 是首次提出面向以太坊区块链智能合约的入侵检测系统,它能检测智能合约的潜在攻击行为。ContractGuard 的入侵检测主要依赖检测潜在攻击可能引发的异常控制流来实现。由于智能合约运行在去中心化的环境以及在高度受限的环境中运行,现有的IDS技术或者工具等以外部拦截形式的部署架构不适合于以太坊智能合约。为了解决这些问题,通过设计一个嵌入式的架构,实现了把 ContractGuard 直接嵌入智能合约的执行代码中,作为智能合约的一部分。在运行时刻,ContractGuard通过相应的context-tagged无环路径来实现入侵检测,从而保护智能合约。由于嵌入了额外的代码,ContractGuard一定程度上会增加智能合约的部署开销与运行开销,为了降低这两方面的开销,基于以太坊智能合约的特性对 ContractGuard 进行优化。实验结果显示,可有效地检测 83%的异常行为,其部署开销仅增加了36.14%,运行开销仅增加了28.17%。     

无线自组织网络中多层综合的节点行为异常检测方法

Ad hoe网络由于采用无线信道、有限的电源和带宽、分布式控制等,会比有线网络更易受到入侵攻击.通常的入侵检测技术具有检测能力单一、缺乏对抗新入侵方式的能力等缺陷.在分布式入侵检测系统(IDS)的基础上,提出一种针对移动节点网络行为的异常检测机制.基于多层综合的观测值序列,采用隐半马尔可夫模型(HSMM)建立描述网络中合法节点正常行为的检测模型,继而对网络中的正常与异常行为进行判断与识别.实验表明,此方法能针对现有多种入侵方式进行有效的检测.     

一种基于粒子群的入侵检测研究

当今攻击网络的手段是多种多样的,为保护网络的用户不受来自网络的攻击,网络在使用中需要安全设备和安全技术。入侵检测技术是一种安全检测技术,该技术能够来阻止网络攻击行为。但要阻止网络的攻击行为,必须检测到该行为。本文在简述了入侵检测技术,粒子群知识后,然后提出了粒子群在入侵检测技术上的应用。该技术在入侵检测上的应用将使得检测方法具有一定的智能性,将粒子群技术应用到入侵检测中属于是首次。本文提出的具有一定智能性检测算法可分为两个步骤：①首先通过函数y=f（x）判断链路中的数据流是否在正常范围内,还是属于异常。②然后如果某种数据流属于异常的流,则使用粒子群算法来对未知属性数据流的属性进行定性判断。本文提出的算法具有一定的智能性,能够作为现有的入侵检测算法的补充。     

无线局域网入侵检测系统的研究

入侵检测系统对于保障无线局域网(WLAN)的安全十分重要。在深入分析当前WLAN安全问题中面临的主要问题后,针对无线局域网的特点,提出并实现了一个分布式无线入侵检测系统。首先对无线局域网网络结构和主要安全技术进行了分析,阐述了入侵检测技术在无线局域网安全体系结构中的重要作用以及目前入侵检测技术存在的主要问题。然后在WLAN环境下实现了一个分布式无线入侵检测系统。研究了诸如Winpcap网络数据包捕获技术,多模式匹配算法中的自动机匹配算法及统计分析算法等具体实现技术。     

Wired and wireless intrusion detection system: Classifications, good characteristics and state-of-the-art

In computer and network security, standard approaches to intrusion detection and response attempt to detect and prevent individual attacks. Intrusion Detection System (IDS) and intrusion prevention systems (IPS) are real-time software for risk assessment by monitoring for suspicious activity at the network and system layer. Software scanner allows network administrator to audit the network for vulnerabilities and thus securing potential holes before attackers take advantage of them.

In this paper we try to define the intruder, types of intruders, detection behaviors, detection approaches and detection techniques. This paper presents a structural approach to the IDS by introducing a classification of IDS. It presents important features, advantages and disadvantages of each detection approach and the corresponding detection techniques. Furthermore, this paper introduces the wireless intrusion protection systems.

The goal of this paper is to place some characteristics of good IDS and examine the positioning of intrusion prevention as part of an overall layered security strategy and a review of evaluation criteria for identifying and selecting IDS and IPS. With this, we hope to introduce a good characteristic in order to improve the capabilities for early detection of distributed attacks in the preliminary phases against infrastructure and take a full spectrum of manual and automatic response actions against the source of attacks.     

Deploying personalized mobile services in an agent-based environment

The mobile Internet allows users to obtain digitized contents and services from wired and wireless networks virtually anywhere at any time via different handheld mobile devices. However, due to the distinct features of mobile users, mobile devices and wireless networks, deploying mobile services is not as straightforward as generally expected. To ensure the success of mobile services, this paper presents a multi-agent framework that considers different contexts to support personalized services on wireless networks. In the proposed approach, client users, content providers, and service providers are all considered as software agents. They interoperate on the same platform to request and deliver mobile services. The most important issues related to agent operations and context awareness in an agent world are also discussed and analyzed. To verify our framework, different application services are developed accordingly on a publicly available middleware platform. Experiments are conducted for both services to evaluate their corresponding performance. The preliminary results show that our multi-agent approach to personalization is promising and efficient in the deployment of mobile services.     

A machine learning based intrusion detection scheme for data fusion in mobile clouds involving heterogeneous client networks

The combination of traditional cloud computing and mobile computing leads to the novel paradigm of mobile cloud computing. Due to the mobility of network nodes in mobile cloud computing, security has been a challenging problem of paramount importance. When a mobile cloud involves heterogeneous client networks, such as Wireless Sensor Networks and Vehicular Networks, the security problem becomes more challenging because the client networks often have different security requirements in terms of computational complexity, power consumption, and security levels. To securely collect and fuse the data from heterogeneous client networks in complex systems of this kind, novel security schemes need to be devised. Intrusion detection is one of the key security functions in mobile clouds involving heterogeneous client networks. A variety of different rule-based intrusion detection methods could be employed in this type of systems. However, the existing intrusion detection schemes lead to high computation complexity or require frequent rule updates, which seriously harms their effectiveness. In this paper, we propose a machine learning based intrusion detection scheme for mobile clouds involving heterogeneous client networks. The proposed scheme does not require rule updates and its complexity can be customized to suit the requirements of the client networks. Technically, the proposed scheme includes two steps: multi-layer traffic screening and decision-based Virtual Machine (VM) selection. Our experimental results indicate that the proposed scheme is highly effective in terms of intrusion detection.     

网络安全战略预警系统的攻击检测技术研究

攻击检测系统是网络安全战略预警系统的重要组成部分，它从现有的入侵检测系统（IDS）出发，应用当前的民用技术来发展更先进的入侵检测系统（IDS），又将数据输入从逻辑入侵拓展到物理、心理和情报攻击，这些都是信息战进攻的一部分，本文主要探讨适合大范围协同攻击的检测技术。     

The use of artificial intelligence based techniques for intrusion detection: a review

The Internet connects hundreds of millions of computers across the world running on multiple hardware and software platforms providing communication and commercial services. However, this interconnectivity among computers also enables malicious users to misuse resources and mount Internet attacks. The continuously growing Internet attacks pose severe challenges to develop a flexible, adaptive security oriented methods. Intrusion detection system (IDS) is one of most important component being used to detect the Internet attacks. In literature, different techniques from various disciplines have been utilized to develop efficient IDS. Artificial intelligence (AI) based techniques plays prominent role in development of IDS and has many benefits over other techniques. However, there is no comprehensive review of AI based techniques to examine and understand the current status of these techniques to solve the intrusion detection problems. In this paper, various AI based techniques have been reviewed focusing on development of IDS. Related studies have been compared by their source of audit data, processing criteria, technique used, dataset, classifier design, feature reduction technique employed and other experimental environment setup. Benefits and limitations of AI based techniques have been discussed. The paper will help the better understanding of different directions in which research has been done in the field of IDS. The findings of this paper provide useful insights into literature and are beneficial for those who are interested in applications of AI based techniques to IDS and related fields. The review also provides the future directions of the research in this area.     

轻量级无线网络入侵检测系统

针对当前流行的无线拒绝服务DoS、伪装STA、伪装AP、WarDriving、暴力破解等无线网络攻击,采用误用检测和异常检测结合的方式,设计并实现了一个针对无线局域网的轻量级无线网络入侵检测系统。系统采用用户自定义攻击规则库、自定义授权AP/STA名单、自定义非法AP/STA名单等方式,能针对无线网络具体环境和用户的不同需要,合理调整入侵检测灵敏度和攻击检测阈值。仿真试验表明,与市场上同类系统相比较,本系统能有效提高无线网络入侵检测效率,大大降低误报率和漏报率。