Nothing Special   »   [go: up one dir, main page]

skip to main content
article

Swarm intelligence in intrusion detection: A survey

Published: 01 November 2011 Publication History

Abstract

Intrusion Detection Systems (IDS) have nowadays become a necessary component of almost every security infrastructure. So far, many different approaches have been followed in order to increase the efficiency of IDS. Swarm Intelligence (SI), a relatively new bio-inspired family of methods, seeks inspiration in the behavior of swarms of insects or other animals. After applied in other fields with success SI started to gather the interest of researchers working in the field of intrusion detection. In this paper we explore the reasons that led to the application of SI in intrusion detection, and present SI methods that have been used for constructing IDS. A major contribution of this work is also a detailed comparison of several SI-based IDS in terms of efficiency. This gives a clear idea of which solution is more appropriate for each particular case.

References

[1]
A hybridization of evolutionary fuzzy systems and ant colony optimization for intrusion detection. The ISC International Journal of Information Security. v2 i1. 33-46.
[2]
Induction of fuzzy classification systems via evolutionary ACO-based Algorithms. International Journal of Simulation, Systems, Science, Technology. v9 i3.
[3]
An ant colony optimization algorithm for network vulnerability analysis. Iranian Journal for Electrical and Electronic Engineering. 106-120.
[4]
Agravat D, Vaishnav U, Swadas PB. Modified ant miner for intrusion detection. In: Proceedings of the Second International Conference on Machine Learning and Computing 2010. p. 228-232.
[5]
Dynamic self-organizing maps with controlled growth for knowledge discovery. IEEE Transactions on Neural Networks. v11 i3. 601-614.
[6]
Alipour H, Khosrowshahi E, Esmaeili M, Nourhossein M. ACO-FCR: applying ACO-based algorithms to induct FCR. In: Proceedings of the World Congress on Engineering (IWCE) 2008. p. 12-17.
[7]
Amini M, Jalili R. Network-based intrusion detection using unsupervised adaptive resonance theory (ART). In: Proceedings of the 4th Conference on Engineering of Intelligent Systems (EIS 2004) 2004.
[8]
Banerjee S, Grosan C, Abraham A. IDEAS: Intrusion Detection Based on Emotional Ants for Sensors. In: Proceedings of the 5th International Conference on Intelligent Systems Design and Applications 2005a. p. 344-349.
[9]
Intrusion detection in sensor networks using emotional ants. International Journal of Applied Science and Computations. v12 i3. 152-173.
[10]
Beni G, Wang J. Swarm intelligence in cellular robotics systems. In: Proceedings of NATO Advanced Workshop on Robots and Biological System 1989. p. 703-712.
[11]
A tutorial on support vector machines for pattern recognition. Knowledge Discovery and Data Mining. v2 i2. 121-167.
[12]
Chang-Lung T, Chun-Chi T, Chin-Chuan H. Intrusive behavior analysis based on honey pot tracking and ant algorithm analysis. In: Proceedings of the 43rd Annual 2009 International Carnahan Conference on Security Technology 2009. p.248-252.
[13]
Tracing denial of service origin: ant colony approach. Applications of Evolutionary Computing.
[14]
Chen ZF, Qian PD, Chen ZF. Application of PSO-RBF neural network in network intrusion detection. In: Proceedings of the 3rd International Symposium on Intelligent Information Technology Application 2009. p. 362-364.
[15]
Support vector networks. Machine Learning. v20. 273-297.
[16]
The DARPA-Lincoln Dataset. Retrieved January 26, 2008, from http://www.ll.mit.edu/IST/ideval/data/data_index.html.
[17]
Deneubourg JL, Goss S, Franks N, Sendova Franks A, Detrain C, Chretien L. The dynamics of collective sorting robot-like ants and ant-like robots. In: Proceedings of the First International Conference on Simulation of Adaptive Behavior: From Animals to Animats. 1990a. p.356-363.
[18]
The self-organizing exploratory pattern of the Argentine ant. Journal of Insect Behavior. v3 i1. 159-168.
[19]
An intrusion detection model. IEEE Transactions of Software Engineering. v13 i2. 222-232.
[20]
Dickerson JE, Dickerson JA. Fuzzy network profiling for intrusion detection. In: Proceedings of the 19th International Conference of the North American on Fuzzy Information Processing Society (NAFIPS). 2000. p.301-306.
[21]
The ant colony optimization meta-heuristic. New Ideas in Optimization. 11-32.
[22]
Ant colony optimization. MIT Press.
[23]
Dozier G, Brown D, Hurley J, Cain K. Vulnerability analysis of AIS-based intrusion detection systems via genetic and particle swarm red teams. In: Proceedings of the Congress on Evolutionary Computation (CEC2004). 2004. p. 111-116.
[24]
Vulnerability analysis of immunity-based intrusion detection systems using genetic and evolutionary hackers. Applied Soft Computing. v7 i2. 547-553.
[25]
Intrusion detection system based on support vector machine and active learning. Computer: Engineering.
[26]
Results of the KDD'99 classifier learning contest. SIGKDD. Explor. Newsl. v1 i2. 63-64.
[27]
Fenet S, Hassas S. A distributed intrusion detection and response system based on mobile autonomous agents using social insects communication paradigm. In: Proceedings of the First International Workshop on Security of Mobile Multiagent Systems (SEMAS). 2001. p. 41-58.
[28]
Feng Y, Wu ZF, Wu KG, Xiong ZY, Zhou Y. An unsupervised anomaly intrusion detection algorithm based on swarm intelligence. In: the Proceedings of the Fourth International Conference on Machine Learning and Cybernetics. 2005. p.3965-3969.
[29]
Feng Y, Zhong J, Ye CY, Wu ZF. Clustering based on self-organizing ant colony networks with application to intrusion detection. In: Proceedings of the Sixth International Conference on Intelligent Systems Design and Applications (ISDA '06). 2006. p.1077-1080.
[30]
Intrusion detection classifier based on dynamic SOM and swarm intelligence clustering. Advances in Congnitive Neurodynamics ICCN. 969-974.
[31]
Network anomaly detection based on DSOM and ACO clustering. Advances in Neural Networks. 947-955.
[32]
Flocks, herds, and schools: a distributed behavioral model. Computer Graphics. v21 i4. 25-34.
[33]
Foukia N. IDReAM: Intrusion Detection and Response executed with Agent Mobility. In: Proceedings of The International Conference on Autonomous Agents and Multi-Agent Systems (AAMAS'05). 2005. p. 264-270.
[34]
Fu X, Hogrefe D, Narayanan S, Soltwisch R. QoS and security in 4G networks. In: Proceedings of the 1st CIC/IEEE Global Mobile Congress (GMC) .2004. p. 117-122.
[35]
Swarm intelligence and SVM based network intrusion feature selection and detection. Technical Report. College of Information Science and Engineering, East China University of Science and Technology, Shanghai.
[36]
Gao HH, Yang HH, Wang XY. Ant colony optimization based network intrusion feature selection and detection. In: Proceedings of 2005 International Conference on Machine Learning and Cybernetics. 2005b. p.3871-3875.
[37]
Selection and detection of network intrusion feature based on BPSO-SVM. Technical Report. College of Information Science and Engineering, East China University of Science and Technology, Shanghai.
[38]
Self-organized shortcuts in the Argentine ant. Naturwissenschaften. v76 i12. 579-581.
[39]
A PSO-based approach to rule learning in network intrusion detection. Fuzzy Information and Engineering. 666-673.
[40]
Haglund AJ, Hatanen K, Sorvari AS. A computer host-based user anomaly detection system using the self-organizing map. In: Proceedings of the International Joint Conference on Neural Networks (IJCNN'00). 2000. p.411-416.
[41]
Methods of conjugate gradients for solving linear systems. Journal of Research of the National Bureau of Standards. v49 i6. 409-436.
[42]
The Internet Exploration Shootout Dataset. Retrieved January 26, 2008, from http://ivpr.cs.uml.edu/shootout/network.html.
[43]
Improving the performance of fuzzy classifier systems for pattern classification problems with continuous attributes. IEEE Transactions on Industrial Electronics. v46 i6. 1057-1068.
[44]
Performance evaluation of fuzzy classifier systems for multi-dimensional pattern classification problems. IEEE Transactions on Systems. Man and Cybernetics. v21 i5. 61-68.
[45]
ACO based distributed intrusion detection system. International Journal of Digital Content Technology and Its Applications. v3 i1. 66-72.
[46]
Minimization and reliability analysis of attack graphs. Technical Report. School of Computer Science, Carnegie Mellon University, USA.
[47]
Jha S, Sheyner O, Wing MJ. Two formal analyses of attack graphs. In: Proceedings of the 15th IEEE Computer Security Foundations Workshop. 2002b. p. 49-63.
[48]
Jian G, Da-Xin L, Bin-Ge C. An induction learning approach for building intrusion detection models using genetic algorithms. In: Proceedings of the Fifth World Congress on Intelligent Control and Automation (WCICA). 2004. p.4339-4342.
[49]
Junbing H, Dongyang L, Chuan C. An improved ant-based classifier for intrusion detection. In: Proceedings of the Third International Conference on Natural Computation (ICNC 2007). 2007. p. 819-823.
[50]
Kanade PM, Hall LO. Fuzzy ants as a clustering concept. In: Proceedings of the 22nd International Conference of the North American Fuzzy Information Processing Society. 2003. p. 227-232.
[51]
The KDD99 Dataset. Retrieved January 26, 2008, from http://kdd.ics.uci.edu/databases/kddcup99/task.html.
[52]
Kennedy J, Eberhart RC. Particle swarm optimization. In: Proceedings of the IEEE International Joint Conference on Neural Networks. 1995. p. 1942-1948.
[53]
Kennedy J, Eberhart R. A discrete binary version of the particle swarm algorithm. In: Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics. 1997. p. 4104-4108.
[54]
Immune system approaches to intrusion detection - a review. Natural Computing. v6 i4. 413-466.
[55]
Kim JW. Integrating artificial immune algorithms for intrusion detection. PhD Thesis. University College London 2002.
[56]
Kohonen T. Self-Organizing Maps. Berlin Germany:Springer-Verlang. 1995
[57]
Anomaly detection for clustering algorithm based on particle swarm optimization. Journal of Jiangsu University of Science and Technology(Natural Science Edition).
[58]
A Swarm-Intelligence-based intrusion detection technique. IJCSNS International Journal of Computer Science and Network Security. v6 i7. 146-150.
[59]
The 1999 DARPA off-line intrusion detection evaluation. Computer Networks. v34 i4. 579-595.
[60]
Liu L, Liu Y. MQPSO based on wavelet neural network for network anomaly detection. In: Proceedings of the 5th International Conference on Wireless Communications, Networking and Mobile Computing (WiCom '09). 2009. p. 1-5.
[61]
Network anomal detection wavelet neural network based on QPSO. Journal of Liaoning Technical University(Natural Science).
[62]
Liu H, Jian Y, Liu S. A new intelligent intrusion detection method based on attribute reduction and parameters optimization of SVM. In: Proceedings of the Second International Workshop on Education Technology and Computer Science (ETCS). 2010. p.202-205.
[63]
Lumer R, Faieta B. Diversity and adaptation in populations of clustering ants. In Proceedings of the Third International Conference on Simulation of Adaptive Behavior: From Animals to Animats. 1994. p. 501-508.
[64]
Wavelet fuzzy neural network based on modified QPSO for network anomaly detection. Applied Mechanics and Materials. v20-23. 1378-1384.
[65]
Ma R, Liu Y, Lin X. Hybrid QPSO based wavelet neural networks for network anomaly detection. In: Proceedings of the Second Workshop on Digital Media and its Application in Museum and Heritages. 2007. p. 442-447.
[66]
Ma J, Liu X, Liu S. A new intrusion detection method based on BPSO-SVM. In: Proceedings of the International Symposium on Computational Intelligence and Design, 2008a. p. 473-477.
[67]
Ma R, Liu Y, Lin X, Wang Z. Network anomaly detection using RBF neural network with hybrid QPSO. In: Proceedings of the IEEE International Conference on Networking, Sensing and Control 2008b. p. 1284-1287.
[68]
MacQueen JB. Some methods for classification and analysis of multivariate observations. In: Proceedings of 5th Berkeley Symposium on Mathematical Statistics and Probability 1967. p. 281-297.
[69]
Mahoney M, Chan PK. An Analysis of the 1999 DARPA/Lincoln Laboratory evaluation data for network anomaly detection. Recent Advances in Intrusion Detection 2003. p. 220-237.
[70]
Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Transactions on Information and System Security (TISSEC). v3 i4. 262-294.
[71]
Michailidis E, Katsikas SK, Georgopoulos E. Intrusion detection using evolutionary neural networks. In: Proceedings of the Panhellenic conference on informatics 2008 (PCI 2008). p. 8-12, 2008.
[72]
A scaled conjugate gradient algorithm for fast supervised learning. Neural Networks. v6 i4. 525-533.
[73]
Muraleedharan R, Osadciw LA. An intrusion detection framework for sensor networks using honeypot and Swarm Intelligence. In: Proceedings of the 6th Annual International Conference on Mobile and Ubiquitous Systems: Networking & Services (MobiQuitous '09) 2009. p. 1-2.
[74]
Introduction to radial basis function networks. Technical report. Institute for adaptive and neural computation Edinburg. Edinburgh University.
[75]
Data mining with an ant colony optimization algorithm. IEEE Transactions on Evolutionary Computation. v6 i4. 321-332.
[76]
Pathan ASK, Hyung-Woo L, Choong Seon H. Security in wireless sensor networks: issues and challenges. In: Proceedings of The 8th International Conference on Advanced Communication Technology (ICACT) 2006. pp. 1048.
[77]
Affective computing. MIT Press, Cambridge, MA.
[78]
C4.5: Programs for machine learning. Morgan Kaufmann, San Mateo, CA.
[79]
An escalated approach to ant colony clustering algorithm for intrusion detection system. Distributed Computing and Networking. 393-400.
[80]
FORK: a novel two-pronged strategy for an agent-based intrusion detection scheme in ad-hoc networks. Computer Communications. v31 i16. 3855-3869.
[81]
Ramos V, Abraham A, ANTIDS: Self organized ant based clustering model for intrusion detection system. In: Proceedings of The Fourth IEEE International Workshop on Soft Computing as Transdisciplinary Science and Technology (WSTST'05) 2005. p. 977-986.
[82]
Why machine learning algorithms fail in misuse detection on KDD intrusion detection data set. Journal of Intelligent Data Analysis. v8 i4. 403-415.
[83]
Guide to intrusion detection and prevention systems (IDPS). Technical report. NIST: National Institute of Standards and Technology. U.S. Department of Commerce.
[84]
Sheyner O, Haines J, Jha S, Lippmann R, Wing JM. Automated generation and analysis of attack graphs. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy 2002. p. 273-284.
[85]
A hybrid approach for feature subset selection using neural networks and ant colony optimization. Expert Systems with Applications. v33 i1. 49-60.
[86]
Soroush E, Saniee Abadeh M, Habibi JA. Boosting ant-colony optimization algorithm for computer intrusion detection. In: Proceedings of The IEEE 20th International Symposium on Frontiers in Networking with Applications 2006.
[87]
Srinoy S, Rajabhat S. Intelligence system approach for computer network security. In: Proceedings of the Fourth IASTED Asian Conference on Communication Systems and Networks 2007. p. 89-95.
[88]
Srinoy S. An adaptive IDS model based on swarm intelligence and support vector machine. In: Proceedings of the International Symposium on Communications and Information Technologies 2006. p. 584-589.
[89]
Swarm Intelligence in Intrusion Detection: A Survey (Online Material), http://www.icsd.aegean.gr/postgraduates/kkolias/swarm-intelligence-in-intrusion-detection/online-resources.pdf
[90]
Improving intrusion detection system through machine learning. Technical Report. ILK Research Group. Tilburg University.
[91]
Tian W, Liu J. Intrusion detection quantitative analysis with support vector regression and particle swarm optimization algorithm. In: Proceedings of International Conference on the Wireless Networks and Information Systems, 2009 (WNIS '09). p. 133-136.
[92]
Tian W, Liu J. A new network intrusion detection identification model research. In: Proceedings of the 2nd International Asia Conference on Informatics in Control, Automation and Robotics (CAR) 2010. p. 9-12.
[93]
A practical guide to wavelet analysis. Bulletin of the American Meteorological Society. v79 i1. 61-78.
[94]
Tsang W, Kwong S. Unsupervised anomaly intrusion detection using ant colony clustering model. In: Proceedings of the 4th IEEE International Workshop on Soft Computing as Transdiciplinary Science and Technology 2005. p. 223-232.
[95]
Tsang CH, Kwong S. Multi-agent intrusion detection system in industrial network using ant colony clustering approach and unsupervised feature extraction. In: Proceedings of the IEEE International Conference on Industrial Technology 2005 (ICIT 2005). p.51-56.
[96]
Ant colony clustering and feature extraction for anomaly intrusion detection. Swarm Intelligence in Data Mining. 101-121.
[97]
The Unix User Dataset. Retrieved January 26, 2008, from http://kdd.ics.uci.edu/databases/UNIX_user_data/UNIX_user_data.htm.
[98]
Vizine AL, de Castro LN, Gudwin RR Text document classification using swarm intelligence. In: Proceedings of the International Conference on Integration of Knowledge Intensive Multi-Agent Systems 2005. p.134-139.
[99]
Wang Q, Megalooikonomou V. A clustering algorithm for intrusion detection. In: Proceedings of the SPIE Conference on Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security 2005. p.31-38.
[100]
Wang J, Hong X, Ren R, Li T. A real-time intrusion detection system based on PSO-SVM. In: Proceedings of the International Workshop on Information Security and Application 2009 (IWISA 2009). p. 319-321.
[101]
Biologically inspired approaches to computer security. Technical Report. 2002. HP Laboratories, Bristol.
[102]
Sociobiology: the new synthesis. 1975. Belknap Press.
[103]
The use of computational intelligence in intrusion detection systems: a review. Applied Soft Computing. v10 i1. 1-35.
[104]
Xiao L, Shao Z, Liu G. K-means algorithm based on particle swarm optimization algorithm for anomaly intrusion detection. In: Proceedings of The Sixth World Congress on Intelligent Control and Automation 2006 (WCICA2006). p. 5854-5858.
[105]
Security in mobile ad hoc networks: challenges and solutions. IEEE Wireless Communications. v11 i1. 38-47.
[106]
Yang S, Wang M, Licheng J. A quantum particle swarm optimization. In: Proceedings of the Congress on Evolutionary Computation 2004 (CEC2004). p. 320-324.
[107]
Zadeh LA. Fuzzy sets. Inf. Control 8 1965. p. 338-353.
[108]
Zainal A, Maarof MA, Shamsuddin SM. Feature selection using rough-dpso in anomaly intrusion detection In: Proceedings of the Conference on Computational Science and its Application (ICCSA) 2007. p. 512-524.
[109]
Wavelet networks. IEEE Transactions on Neural Networks. v3 i6. 889-898.
[110]
Zhang Q, Feng W. Network intrusion detection by support vectors and ant colony. In: Proceedings of the 2009 International Workshop on Information Security and Application 2009. p. 639-642.
[111]
Zhao C, Wang W. An improved PSO-Based rule extraction algorithm for intrusion detection. In: Proceedings of International Conference on the Computational Intelligence and Natural Computing 2009 (CINC '09). p.56-58.
[112]
Zhou T, Li Y, Li J. Research on intrusion detection of SVM based on PSO. In: Proceedings of the International Conference on Machine Learning and Cybernetics 2009. p. 1205-1209.

Cited By

View all
  • (2024)DAIDNet: A Lightweight Domain-Aware Architecture for Automated Detection of Network PenetrationsIEEE Transactions on Network and Service Management10.1109/TNSM.2024.338494221:3(2900-2908)Online publication date: 1-Jun-2024
  • (2023)A Comprehensive Survey on Machine Learning-Based Intrusion Detection Systems for Secure Communication in Internet of ThingsComputational Intelligence and Neuroscience10.1155/2023/89819882023Online publication date: 1-Jan-2023
  • (2023)Optimizing intrusion detection systems using parallel metric learningComputers and Electrical Engineering10.1016/j.compeleceng.2023.108869110:COnline publication date: 1-Sep-2023
  • Show More Cited By
  1. Swarm intelligence in intrusion detection: A survey

    Recommendations

    Comments

    Please enable JavaScript to view thecomments powered by Disqus.

    Information & Contributors

    Information

    Published In

    cover image Computers and Security
    Computers and Security  Volume 30, Issue 8
    November, 2011
    290 pages

    Publisher

    Elsevier Advanced Technology Publications

    United Kingdom

    Publication History

    Published: 01 November 2011

    Author Tags

    1. Ant colony clustering
    2. Ant colony optimization
    3. Intrusion detection
    4. Particle swarm optimization
    5. Survey
    6. Swarm intelligence

    Qualifiers

    • Article

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)0
    • Downloads (Last 6 weeks)0
    Reflects downloads up to 01 Dec 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)DAIDNet: A Lightweight Domain-Aware Architecture for Automated Detection of Network PenetrationsIEEE Transactions on Network and Service Management10.1109/TNSM.2024.338494221:3(2900-2908)Online publication date: 1-Jun-2024
    • (2023)A Comprehensive Survey on Machine Learning-Based Intrusion Detection Systems for Secure Communication in Internet of ThingsComputational Intelligence and Neuroscience10.1155/2023/89819882023Online publication date: 1-Jan-2023
    • (2023)Optimizing intrusion detection systems using parallel metric learningComputers and Electrical Engineering10.1016/j.compeleceng.2023.108869110:COnline publication date: 1-Sep-2023
    • (2023)Knacks of a hybrid anomaly detection model using deep auto-encoder driven gated recurrent unitComputer Networks: The International Journal of Computer and Telecommunications Networking10.1016/j.comnet.2023.109681226:COnline publication date: 26-Apr-2023
    • (2022)Temporal Logic-Based Artificial Immune System for Intrusion DetectionWireless Communications & Mobile Computing10.1155/2022/46857542022Online publication date: 1-Jan-2022
    • (2022)A Review on Swarm Intelligence and Evolutionary Algorithms for Solving the Traffic Signal Control ProblemIEEE Transactions on Intelligent Transportation Systems10.1109/TITS.2020.301429623:1(48-63)Online publication date: 1-Jan-2022
    • (2022)Corona virus optimization (CVO): a novel optimization algorithm inspired from the Corona virus pandemicThe Journal of Supercomputing10.1007/s11227-021-04100-z78:4(5712-5743)Online publication date: 1-Mar-2022
    • (2021)Intrusion detection in internet of things using supervised machine learning based on application and transport layer features using UNSW-NB15 data-setEURASIP Journal on Wireless Communications and Networking10.1186/s13638-021-01893-82021:1Online publication date: 21-Jan-2021
    • (2021)Comparing and Analyzing Applications of Intelligent Techniques in Cyberattack DetectionSecurity and Communication Networks10.1155/2021/55618162021Online publication date: 1-Jan-2021
    • (2021)Computational Intelligence in Remote Sensing Image Registration: A surveyInternational Journal of Automation and Computing10.1007/s11633-020-1248-x18:1(1-17)Online publication date: 1-Feb-2021
    • Show More Cited By

    View Options

    View options

    Login options

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media