Artificial Intelligence-Based Intrusion Detection System Analysis

This report provides a comprehensive overview of AI-based intrusion detection systems, exploring the increasing significance of cybersecurity in today's enterprise environments. It distinguishes between signature-based and anomaly-based intrusion detection systems, highlighting their respective strengths and weaknesses. The report delves into the rise of cyber threats, including zero-day attacks, and the critical need for advanced intrusion detection methods. It examines various AI-based techniques, such as decision trees, support vector machines, neural networks, and Bayesian networks, discussing their applications and advantages. The report also reviews intrusion detection techniques based on knowledge, anomalies, and signatures. It further analyzes the challenges faced by intrusion detection systems in detecting intrusion evasion and proposes solutions. The conclusion summarizes the findings, discusses future prospects, and emphasizes the potential of AI in enhancing intrusion detection capabilities.

Artificial Intelligence-Based Intrusion Detection System1
ARTIFICIAL INTELLIGENCE-BASED INTRUSION DETECTION SYSTEM
Course
University
Date

Artificial Intelligence-Based Intrusion Detection System2
Artificial Intelligence-Based Intrusion Detection System
Cyberattacks in today's enterprise environments is enormous, and it's just becoming bigger.
As a result, monitoring and strengthening a company's cybersecurity posture requires more
than just human intervention.
The goal of a network intrusion detection is to detect and track hostile activity. The majority
of existing IDSs fall into one of two groups. They are signature-based and anomaly-based
intrusion detection systems. A signature-based intrusion detection attempts to identify
intrusions by matching previously known assaults with incoming traffic. These intrusions are
kept in the database like a signature. Intrusion detection system detects existing assaults well,
but it frequently fails to detect fresh threats. The following category is known as anomaly-
based intrusion detection systems (IDS). Furthermore, there have been an existence of an
upsurge in security concerns like nil attacks targeting internet users. As a result, computer
security is becoming increasingly important as the usage of information technology has been
ingrained in our everyday lives. for that reason, negligible attacks have had a substantial
impact on countries like Australia and the United States. As per the Threat Report, over three
billion nil assaults were recorded in 2016, with the number and severity of nil attacks being
significantly higher than previously. More and more businesses are becoming exposed to
Internet-based assaults and invasions. An incursion or assault is "any collection of acts that
seek to violate the security goals." Availability, Transparency, Anonymity, Equity, and
Assurance are all critical security concerns (Gill & Gill 2018). Intruders are divided into four
types: exploring, disruption of access, user-to-root, and remote-to-user assaults. A lot of anti-
intrusion technologies have been developed to prevent a significant percentage of Internet
assaults. According to (Gmiden et al. 2019), intrusion detection systems are one of six anti-

Artificial Intelligence-Based Intrusion Detection System3
intrusion systems, including prevention, preemption, deterrent, diversion, surveillance, and
remedies. The flawless detection of an incursion is the most critical of these elements. In
section two, intrusion detection systems using AI-based approaches will be discussed.
Some Intrusion detection systems were created using a single classification approach, while
others used several classification methods (Aloqaily, et al 2019). Nevertheless, there is no
complete assessment of these intrusion detection algorithms.
The purpose of this study is threefold. The first goal is to provide a short primer to intrusion
detection systems, intrusion detection system construction, and intrusion detection system
categorization. The paper's second goal is to present a study of previous research on AI-based
strategies for intrusion detection by investigating the origin of data sets, computation
requirements, classification methodology employed, classifier architecture, dataset,
segmentation techniques, and other experimentation setting setups. This article focuses on the
fundamental Methodologies, which include Decision Tree, Support Vector Machine (SVM),
Rule-Based, Fuzzy Logic, Data Mining, Genetic Algorithm, Neural Network (NN), Bayesian
Network, Markov model, and clustering techniques.
Intrusion Detection System
One of the standardized parts of protection systems is an intrusion detection system, which is
described as "an effective cybersecurity technology that can identify, mitigate, and perhaps
respond to computer threats." It examines target activity sources in system or computer
devices, such as audit and communication traffic information, and employs different
methodologies to deliver security agencies (Smys, et al 2020). The primary goal of intrusion
detection systems is to identify all intrusions as quickly as possible. The use of intrusion
detection systems enables network managers to discover objective security breaches. External
attackers attempting to obtain unlawful access to system security architecture or rendering

Artificial Intelligence-Based Intrusion Detection System4
resources inaccessible to insiders misusing their administrator privileges are examples of
security goal violations. Several IDS architectures have been presented as the number of
computer assaults has grown over time. According to (Nisioti et al. 2018), standard IDS
components include the following: The identity to be watched for incursions is the Internet. It
might be a solitary host or a chain. The computing and storage unit oversees the gathering of
data from various events, converting it into the correct format, and storing it on disk. IDS'
brain is the data analysis and processing unit. It includes all the capabilities required to detect
unusual activity in attack flow. When an assault is detected, a signal is generated. Depending
on the kind of intrusion detection systems, the system may take action to resolve the issue
directly, or a signal may be sent to the system administrator to take necessary action; Signal:
This section of the network processes all IDS information. The result might be an automatic
reaction to an invasion or a harmful behavior warning for an information security manager.
Intrusion Detection Techniques
Many strategies from various fields have been used in the literature to identify intrusions.
Statistical approaches, knowledge-based strategies, and artificial intelligence (AI)-based
methods are the most common. The state of the system is depicted from a randomized
perspective in statistics-based intrusion detection systems. On the other extreme, knowledge-
based intrusion detection approaches attempt to extract the asserted behavior from accessible
system data (protocol specifications, network traffic instances, etc.). Lastly, AI-based IDS
approaches need the creation of a direct or indirect framework that enables anomalies to be
classified (Hajiheidari et al., 2019).

Artificial Intelligence-Based Intrusion Detection System5
Techniques based on knowledge
This set of approaches is often known as an expert system method. This method necessitates
the creation of a knowledge base that mirrors the actual traffic characteristics. Actions that
deviate from this conventional profile are considered an incursion (Ustun et al., 2021). Unlike
the other types of AIDS, the conventional profile version is often built on human knowledge
in the form of a set of principles that attempt to characterize normal system functioning.
The key advantage of knowledge-based approaches is the potential to decrease false-positive
alerts because the system is aware of all typical activities. However, in a continuous evolving
computing environment, this type of IDS requires a frequent upgrade on knowledge
regarding predicted normal behavior, that is a time-consuming process due to the difficulty of
acquiring information concerning all usual behaviors.
Advantage
This approach is incredibly simple for the user; no further input is required.
Issues with the technique
One serious issue is that similar sorts of occurrences tend to multiply till the system
overpowers the security officer with just that sort of event. Obtaining extra negative input
from the user may aid in combating this.
Intrusion Detection Strategies Based on Anomalies
These solutions, also known as behavior-based, follow activity within a given scope in search
of instances of harmful conduct, as they describe it, that is a challenging task that
occasionally results in wrongful convictions. External URLs of Web activity, for example,
may be evaluated, and sites with specific domains or URL contents may be automatically
prohibited, even if it's a human being attempting to get there for a business-legitimate cause.

Artificial Intelligence-Based Intrusion Detection System6
Intrusion Detection Methods Based on Signatures
This method, also referred as knowledge-based, entails searching for certain
signatures combinations that, when found, nearly always indicate negative information.
Malware, or packets delivered by malware to establish or leverage a security vulnerability,
are examples (Aneja, et al, 2018). Since the search criterion is so tight, these solutions yield
less false positive results than anomaly solutions, and they only include signatures which are
in the query database.
Antivirus software and virtual private networks (VPNs) can assist protect against remote
malware and ransomware assaults, but they typically rely on signatures. This implies that
keeping up with signature definitions is vital to be safe against the current threats.
If virus definitions fall behind, either due to a failure to update the antivirus solution or a lack
of awareness on the part of the software manufacturer, this can be a problem. As a result, if a
new sort of malware assault emerges, signature protection may be ineffective.
Artificial Intelligence-Based Techniques
The main benefit of using AI is the versatility (compared to conventional method's threshold
determination); scalability (vs. conventional technique's particular rules); analytical thinking
(and identification of new patterns); quick computation (better than expected, in fact); and
gaining experience. Many writers (Li et al. 2018) have classified AI-based approaches.

Artificial Intelligence-Based Intrusion Detection System7
Advantages
With today's rapidly developing cyberattacks and rapid proliferation of devices, AI and
machine learning can assist in keeping up with cybercriminals, automating threat detection,
and responding more efficiently than traditional software-driven or manual procedures
(Belani, 2021).
By using Sophisticated algorithms AI systems are being manipulated and trained to detect
malware, ransomware, run pattern recognition and detect even the tiniest characteristics of
any malware or ransomware before it enters a system.
With natural language processing, AI can also provide higher predictive intelligence by
scouring through articles, news, and research on cyber dangers and curating material on its
own. This can provide information on new anomalies, cyberattacks, and countermeasures.
Endpoint security powered by AI takes a different approach, creating a baseline of behavior
for the endpoint through a series of training sessions. If something unusual happens, AI can
detect it and take appropriate action, such as notifying a technician or restoring to a safe state
after a ransomware assault. Rather than waiting for signature changes, this enables proactive
protection against attacks.

Artificial Intelligence-Based Intrusion Detection System8
Examining Similar Studies
The research on vulnerability scanning is especially in comparison based on the following
criteria: source of audit data (Host/Network/Hybrid), processing criteria
(Misuse/Anomaly/Hybrid), technique used, classifier design (Single/Hybrid/Ensemble/Multi-
classifiers), dataset, feature reduction technique used, and classes used for attack
classification. The IDS might receive the data from a host, a network, or a hybrid (both host
and network). For example, the host data is information gleaned from the operating system,
whereas the network data is information gleaned from network packets. To identify
intrusions, IDS can employ a variety of processing criteria, including misuse-based, anomaly-
based, and hybrid. IDS can use a variety of classification algorithms like neural networks,
SVMs, Bayesian networks, and so on. The IDS architecture can be built around a single
classification approach (single classifier) or several classification techniques (hybrid and
ensemble classifier). The dataset is the benchmarked dataset that is utilized for IDS
validation. Before implementing the classification approach, the data can be reduced using a
variety of feature reduction strategies. The reduction of data for IDS processing leads to
earlier detection of attacks and increased detection accuracy.
The Intrusion Detection System (IDS) Faces A Challenge in Detecting Intrusion
Evasion.
SIDS together with AIDS have difficulties in detecting assaults disguised by evasive
strategies. The effectiveness of evasion tactics would be judged by IDS's capacity to recover
the actual signature of the assaults or to generate fresh signatures to conceal the change of the
assaults (Souri and Hosseini 2018). The resilience of IDS against various evasion tactics still
must be investigated further. SIDS in sequences, for instance, can detect departures from

Artificial Intelligence-Based Intrusion Detection System9
basic mutations like manipulating space letters, but they are still ineffective against a variety
of encryption schemes.
How the system will solve the problems above
As a result, an AI that seeks to limit false negatives to a minimal would have to be calibrated
to identify even little deviations from the learnt facts. As a result, there would be several
misleading positives because discrepancies are unavoidable. A different strategy is taken
when prohibited behavior is discovered. There's also the circle, since the training data
includes information about what's normal, but there are also additional dots that indicate the
many types of banned occurrences. Therefore, once we have an occurrence that is somewhat
similar to regular activity but also somewhat similar to a banned event, it will be pulled to
either the normal or prohibited centers. As a result, it would wind up far from the regular
center in any scenario.

Artificial Intelligence-Based Intrusion Detection System10
Conclusion And Future Prospects
In this work, we detailed a study of intrusion detection system approaches, kinds, and
technologies and their benefits and drawbacks. Several machine learning algorithms for
detecting zero-day threats are discussed. However, such techniques may have the issue of
producing and upgrading updates on current assaults, resulting in many false alarms or low
accuracy. We evaluated previous research findings and investigated modern strategies for
AIDS improved performance to overcome IDS challenges.
This research has evaluated numerous intrusion detection systems and their categorization
depending on multiple components concisely. A complete evaluation of several AI-based
intrusion detection approaches is provided. A multi-classifier-based strategy is explained,
which leads to the formal identification of known and new assaults. Various research on
artificial intelligence-based intrusion detection approaches is evaluated by considering
several characteristics such as audit data source, handling criteria, a technique utilized,
classifier layout, dataset, dimension reduction methodology, and categorization classes.
Artificial intelligence is quickly becoming a must-have tool for improving the performance of
IT security teams. Humans can no longer scale to adequately safeguard an enterprise-level
attack surface; thus, AI provides much-needed analysis and threat detection that security
professionals can use to reduce breach risk and improve security posture.
It can also be shown that by taking into account proper base classification methods, retraining
sample groups, and fulfilling the requirements, the recognition rate of hybrid and ensemble
approaches may be enhanced. The hybrid/ensemble technique, on the other hand, has doubled
the computation complexity. In the future, there will be an urgent need to investigate the
following concerns connected to AI-based approaches in ID.

Artificial Intelligence-Based Intrusion Detection System11
Reference List
Gill, R.D., Kapur, N. and Gill, H.S., 2018. Increase security of data concerning both
confidentiality and integrity overcloud. International Journal of Applied Engineering
Research, 13(10), pp.7388-7391.
Nisioti, A., Mylonas, A., Yoo, P.D. and Katos, V., 2018. From intrusion detection to attacker
attribution: A comprehensive survey of unsupervised methods. IEEE Communications
Surveys & Tutorials, 20(4), pp.3369-3388.
Hajiheidari, S., Wakil, K., Badri, M. and Navimipour, N.J., 2019. Intrusion detection systems
in the Internet of things: A comprehensive investigation. Computer Networks, 160,
pp.165-191.
Li, J., Zhao, Z., Li, R. and Zhang, H., 2018. Ai-based two-stage intrusion detection for
software-defined IoT networks. IEEE Internet of Things Journal, 6(2), pp.2093-2102.
Souri, A. and Hosseini, R., 2018. A state-of-the-art survey of malware detection approaches
using data mining techniques. Human-centric Computing and Information Sciences, 8(1),
pp.1-22.
Gmiden, M., Gmiden, M.H. and Trabelsi, H., 2019, March. Cryptographic and Intrusion
Detection System for automotive CAN bus: Survey and contributions. In 2019 16th
International Multi-Conference on Systems, Signals & Devices (SSD) (pp. 158-163).
IEEE.
Aneja, M. J. S., Bhatia, T., Sharma, G., & Shrivastava, G. (2018). Artificial intelligence-
based intrusion detection system to detect flooding attack in VANETs. In Handbook of
Research on Network Forensics and Analysis Techniques (pp. 87-100). IGI Global.
Ustun, T. S., Hussain, S. S., Yavuz, L., & Onen, A. (2021). Artificial Intelligence Based Intrusion
Detection System for IEC 61850 Sampled Values Under Symmetric and Asymmetric Faults. IEEE
Access, 9, 56486-56495.

Artificial Intelligence-Based Intrusion Detection System12
Smys, S., Basar, A., & Wang, H. (2020). Hybrid intrusion detection system for internet of
Things (IoT). Journal of ISMAC, 2(04), 190-199.
Aloqaily, M., Otoum, S., Al Ridhawi, I., & Jararweh, Y. (2019). An intrusion detection
system for connected vehicles in smart cities. Ad Hoc Networks, 90, 101842.
Belani, G., 2021. The Use of Artificial Intelligence in Cybersecurity: A Review. [online]
Computer.org. Available at: <https://www.computer.org/publications/tech-news/trends/the-
use-of-artificial-intelligence-in-cybersecurity> [Accessed 22 November 2021].