Intrusion detection in networks using crow search optimization algorithm with adaptive neuro-fuzzy inference system

Abstract

Intrusion detection system has become the fundamental part for the network security and essential for network security because of the expansion of attacks which causes many issues. This is because of the broad development of internet and access to data systems around the world. For detecting the abnormalities present in the network or system, the intrusion detection system (IDS) is used. Because of the large volume of data, the network gets expanded with false alarm rate of intrusion and detection accuracy decreased. This is one of the significant issues when the network experiences unknown attacks. The principle objective was to expand the accuracy and reduce the false alarm rate (FAR). To address the above difficulties the proposed with Crow Search Optimization algorithm with Adaptive Neuro-Fuzzy Inference System (CSO-ANFIS) is used. The ANFIS is the combination of fuzzy interference system and artificial neural network, and to enhance the performance of the ANFIS model the crow search optimization algorithm is used to optimize the ANFIS. The NSL-KDD data set was used to validate the performance of intrusion detection of the proposed model and the experiment results are compared with other existing techniques for overall performance validation. The results of the intrusion detection based on the NSL-KDD dataset was better and efficient compared with those models because the detection rate was 95.80% and the FAR result was 3.45%.

Introduction

Recently, the communication over internet has become more extensive and the requirement of data security over network is essential. For detecting the abnormalities present in the network or system, the IDS is used. Because of the large volume of data, the network gets expanded with false alarm rate of intrusion and detection accuracy gets decreased. This is another significant issue once the network experiences unknown attacks. The principle intention was to expand the accuracy and reduce the FAR. To address these difficulties, the proposed Crow Search Optimization algorithm with Adaptive Neuro-Fuzzy Inference System (CSO-ANFIS) is used.

The conception of IDS was first presented by Anderson in 1980 and is acquainted with the network system by Heberlein in 1990. An IDS is a mechanism or tool utilized to avoid unapproved access and for detecting attacks over a system or a network by determining the activity in the system or in the network [1]. The IDS is utilized to monitor the malignant traffic in a specific node and network. It could play as a second line of defence that could protect the network from attackers. Intrusion is an undesirable or malevolent action that was dangerous for sensor nodes. IDS can be a hardware or software tools [12]. IDS may review and analyse machines and activities of user, identify signatures of known attacks and detect malignant network action. The purpose of IDS was to check the networks and nodes, identify different interruptions in the network, and notify the user after interruptions had been identified [2].

The IDS functions as an alarm or network perceiver. It prevents from harm to the system by creating a notification before the intruders start to attack. It could distinguish both inside and outside attacks. Internal attacks were started by malignant or undermined nodes which are segment of the network during external attacks were initiated by third parties who are started by the external networks. IDS distinguish the packets of the network and decide if they are real users or intruders. There are mostly three parts of IDS: Monitoring, Analysis and detection, and Alarm. The monitoring module observes the network traffic, resources and patterns. Analysis and Detection are the key part of IDS that identifies the attacks as per specific algorithm. The alarm module rises an alert when the intrusion is determined [3].

Generally, IDS perform based on two particular strategies, i.e., statistical anomalies and pattern matching. The pattern matching was called misuse based or signature-based IDS that can find the known attack patterns as their signatures have saved in the IDS database. The primary drawback of pattern matching was its inadequacy to distinguish obscure attacks in which the signatures were not in the database of IDS. While, in the statistical anomaly-based system known as anomaly-based IDS (AIDS), normal behaviour patterns have saved in the IDS database. In these frameworks, all activities over the network were observed and considered precisely, any changes from normal patterns were considered as an attack where the IDS produce an alert to indicate security manager of network regarding the recently distinguished intrusions. The primary benefit of AIDS was its capacity to recognize unknown attack. It must be noticed that every single strange pattern might be labeled as a potential attack regardless of whether they are not attacks; hence, FP will be higher in those methods [4].

A normal IDS is made out of sensors, an analysis engine, and a reporting system. Sensors were placed at various network locations or host and its primary objective was to gather information. The information gathered are transmitted to the analysis engine, which was capable to analyze the gathered information and identify intrusions. Once an intrusion is identified by the analysis engine, the reporting system produces a notification to the administrator of network. IDS was classified as Host-based IDS (HIDS) and Network-based IDS (NIDS) [5].

The implement of IDS relies upon environment. The NIDS absorbs traffic packets of network to identify intrusions and malignant attacks. The NIDS might be hardware or else software-based system. The HIDS was developed to be implement on a single system and to secure the system from malignant attacks which could damage its OS or information. The HIDS normally relies upon features in the host condition, like the log-files in a PC. These features or metrics were utilized as input to the HIDS decision engine. Along these, feature extraction from the host environment functions as the reason for any HIDS [6].

The remaining work is presented as follows: section 2 represents the discussion of work related to intrusion detection, section 3 represents the proposed methodology, section 4 represents the dataset description and results, and section 5 represents the conclusion and future work.