Simple Network Management Protocol (SNMP) is extensively utilized for monitoring and managing computer networks. This paper synthesizes and reviews recent research on harnessing SNMP data for developing effective network security solutions driven by artificial intelligence and machine learning techniques. The comprehensive device-level visibility and timely data provided by SNMP offers significant potential to enable high-performance intrusion detection systems, security analytics, and real-time monitoring capabilities to protect against evolving cyber threats. However, inherent vulnerabilities in versions like SNMP v1/v2c persist, especially due to default community strings allowing uncontrolled access. A number of techniques like newer SNMPv3 standard have been proposed to improve security through encryption, authentication, and fine-grained access control. Additionally, general best practices around firewalling, traffic monitoring, and compliance audits are recommended for robust SNMP deployment. The literature reviewed demonstrates SNMP’s capabilities in enabling anomaly detection with over 99% accuracy by applying supervised learning methods like random forests and neural networks to SNMP Management Information Base (MIB) data. The network-centric visibility offered by SNMP's extensive statistics on traffic configurations and behaviors provides an invaluable advantage over packetlevel data for developing intelligent detection models. Beyond intrusion detection systems, SNMP data has also shown significant utility for security analytics like attack pattern discovery, bandwidth modeling, and large-scale threat intelligence by aggregating data from distributed network devices. Further research opportunities exist in areas like feature engineering, model optimization, and continued evaluation of evolving attacks patterns. In conclusion, with appropriate secure configurations, SNMP provides the comprehensive and real-time data needed by modern artificial intelligence security applications in a scalable manner due to its device-centric focus, standardized schema, and ubiquitous deployment

IP Multimedia Subsystem (IMS) supports high-speed transmission of multi-media like data, audio, and video between mobiles and other wireless devices. IMS is the most suitable for multimedia communication across multiple networks using the Internet of Things (IoT) and cloud computing. IoT-IMS can efficiently manage the huge amount of data generated by smart devices for audio-video during live streaming applications. During these services, the main problem is that an intruder can launch a Session Initialization Protocol (SIP) messages flooding attack on IMS that does not have the functionality to prevent itself from these types of attacks. In this paper, an intrusion detecting and preventing system (IDPS) is proposed that effectively detects the register flooding and spoofing attacks using SIP messages. We proposed a watermark embedding algorithm on the user side and an extraction algorithm on receiving side. A test-bed is set up for IMS where we have considered four different scenarios to evaluate the IDPS approach as compared to counterparts. Results illustrate the dominance of our scheme in terms of response time, register flooding attack detection ratios, CPU load utilization, fault detection ratio, and memory utilization. The fault detection ratio averagely 98.18

The rise in Internet users has brought with it the impending threat of cybercrime as the Internet of Things (IoT) increases and the introduction of 5G technologies continues to transform our digital world. It is now essential to protect communication networks from illegal intrusions in order to guarantee data integrity and user privacy. In this situation, machine learning techniques used in data mining have proven to be effective tools for constructing intrusion detection systems (IDS) and improving their precision. We use the well-known AWID3 dataset, a comprehensive collection of wireless network traffic, to investigate the effectiveness of machine learning in enhancing network security. Our work primarily concentrates on the Krack and Kr00k attacks, which target the most recent and dangerous flaws in IEEE 802.11 protocols. Through diligent implementation, we were able to successfully identify these threats using an IDS model that is based on machine learning. Notably, the resilience of our method was demonstrated by our Ensemble classifier’s astounding 99% success rate in detecting the Krack attack. The effectiveness of our suggested remedy was further demonstrated by the high accuracy rate of 96.7% displayed by our Neural Network-based model in recognizing instances of the Kr00k attack. Our research shows the potential for considerably boosting network security in the face of new threats by leveraging the capabilities of machine learning and a diversified dataset. Our findings open the door for stronger, more proactive security measures to protect IEEE 802.11 networks’ integrity, resulting in a safer online environment for all users.

The growing shift toward Internet of Things (IoT)-based solutions expands the attack surface of systems by connecting an extensive network of heterogeneous devices and technologies. The heterogeneity of IoT devices and the scale of the network often make conventional security measures impractical. Therefore, recent research efforts have focused on machine learning (ML)-based device-agnostic IoT security solutions. However, most proposed solutions have focused solely on detecting malicious traffic in IoT networks. While this is important, further information about the attack is needed to provide a comprehensive defense before, during, and after the incident. To address this gap, we proposed an anomaly-based intrusion detection model that detects malicious traffic and identifies the attack category and subcategory with high accuracy, recall, precision, and F1-score. The proposed intrusion detection model is an ensemble model that integrates multiple ML models to produce more robust and reliable detections. For evaluation, we performed three sets of experiments: (1) a binary classification to detect malicious traffic; (2) a multi-class classification to detect the attack category; and (3) a multi-class classification to detect the attack subcategory. In the experiments, our model achieved an accuracy, recall, precision, and F1-score of 100% for the binary detection; a precision, recall, and F1-score of 99% and an accuracy of 100% for the multi-class category classification; and an accuracy, recall, precision, and F1-score of 88% for the multi-class subcategory classification. These results suggest that the proposed model can reliably detect anomalies in IoT devices.

Unmanned aerial systems (UASs) create an extensive fighting capability of the developed military forces. Particularly, these systems carrying confidential data are exposed to security attacks. By the wireless’s nature within these networks, they become susceptible to different kinds of attacks, hence, it seems essential to design the appropriate safety mechanism in such networks. The sinkhole attack is one of the most dangerous and threatening attacks amongst types of attack in UAS. A malicious UAV exists in such a threat attacking as a black hole for absorbing all traffic in the network. Mainly, in a Flow-based protocol, the attacker considers the requests on the route, then, it replies to the target UAV such as high quality or the best route towards Gard station. The malicious UAV is able to only insert itself on one occasion between the nodes relating to each other (such as sink node and sensor node), and act for passing packets among them. In this study, the malicious attacks are detected and purged using two stages were. In the first stage, some principles and rules are used to detect black hole, gray hole, and sinkhole attacks. In the second stage, using a smart agent-based strategy negotiation procedure for three steps, a defense mechanism is designed to prevent these attacks. The smart agent is used by reliable neighbors via the negotiation procedure for three steps, hence, the traffic formed by the malicious UAV is not considered. The suggested protocol is called SAUAS. Here, the technique is assessed through extensive simulations performed in the NS-3 environment. Based on the simulation outcomes, it is indicated that the UAS network performance metrics are enhanced based on the packet delivery rate, detection rate, false-negative rate and false-positive rate.

Intrusion Detection Systems (IDS) plays a part in modern cyber security, as a result of the increasing need for cyber security systems in the “real” world due to the increasing number of cyber attacks, more sophisticated systems are required in order to prevent these attacks - an IDS can provide this protection. Due to the sophistication of these systems, they must be properly understood, developed and analyzed - research papers can be used as a tool to improve IDS systems. This paper is composed of two main sections: a survey and a taxonomy, providing information, reviews and interpretations from relevant papers, a timeline of important papers, a discussion on the future of IDS and a classification on IDS and how to apply this.

The smart grid system, an improvised form of the traditional grid, is considered a critical cyber-physical system. Due to its complex combination of smart and legacy technologies, this technology is characterized by a wide range of features such as full duplex communication, advanced metering infrastructure, remote monitoring, and control. However, despite this system’s substantial environmental and socio-economic impact on modern life, it poses severe security vulnerabilities due to its integration and interconnected and interdependent cyber-physical components. Based on the rapid development of cyber-physical systems (CPS), academics and industries have investigated relevant techniques to enhance and strengthen the security measures of the SG system. The intrusion detection system is a countermeasure, a powerful safeguard against various cyber-attacks and threats. The contribution of the IDSs to the SG paradigm is examined in this study. A comprehensive review has been presented in this study, highlighting different techniques, basic ideas, and analyses. Besides discussing the contemporary pertinent research studies, the shortcomings of the existing IDS for the SG system are also identified with a recommendation for future research direction.

The Internet of Things (IoT) has a growing presence in society's daily lives. These lightweight devices can be easily deployed and maintained, enabling extensive adoption in different environments. Furthermore, one of the most promising areas for using IoT devices is healthcare, comprising devices referred to as the Internet of Medical Things (IoMT). Several examples of healthcare services are supported by IoMT devices, e.g., continuous health monitoring. Conversely, there is an increasing concern with the cybersecurity aspects of these devices, and several attacks against IoT infrastructures have been launched in the past few years. These cybersecurity concerns also apply to healthcare applications, where the tradeoff between the benefits and security of IoMT devices must be observed. Given the complexity and amount of data IoMT network traffic generates, advanced methods become especially useful in these environments. Although Machine Learning (ML) brings various techniques and solutions to improve cyberattack detection, prevention, and mitigation, essential features are not addressed in the current state-of-the-art benchmark dataset contributions. Thereupon, the main goal of this research is to propose a realistic benchmark dataset to enable the development and evaluation of IoMT security solutions. In order to accomplish this, 18 attacks were executed against an IoMT testbed composed of 40 IoMT devices (25 real devices and 15 simulated devices), considering the plurality of protocols used in healthcare (e.g., Wi-Fi, MQTT, and Bluetooth). These attacks are categorized into five classes: DDoS, DoS, Recon, MQTT, and spoofing. This effort aims to establish a baseline complementary to the state-of-the-art contributions. The outcome supports researchers in investigating and developing new solutions to make healthcare systems more secure using different mechanisms (e.g., machine learning - ML). This research goes beyond merely conducting attacks on IoMT devices. We also attempt to capture the lifecycle of these devices in different vital phases, from the moment they join the network until they leave, which is called profiling. Profiling allows the different classifiers to identify anomalies of each device individually in the healthcare network. The CICIoMT2024 dataset has been published on CIC's dataset page, making it available for other researchers to use.

The development of wireless sensor networks (WSNs) technology comes with inherent limitations and vulnerabilities that make it exploitable by intruders. The fundamental goal of this article is to solve security problems related to black hole attacks, which interfere with the proper performance of the network and can lead to data leakage and loss. The proposed solution in this article is to apply IDS to a WSN for the first time. We also used the NS2.35 simulator to compare the three routing protocols, AODV, AODV under Hacker Node (HNAODV), and the proposed solution (IDSHNAODV) in the WSN model to reduce the effects of black hole attacks.

It is strongly believed that technology can reap the best only when it can be tamed by all stakeholders. Big data technology has no exception for this and even after a decade of emergence, the technology is still a herculean task and is in nascent stage with respect to applicability for many people. Having understood the gaps in the technology adoption for big data in the contemporary world, the present exploratory research work intended to highlight the possible prospects of big data technologies. It is also advocated as to how the challenges of various fields can be converted as opportunities with the shift in the perspective towards this evolving concept. Examples of apex organizations like (IMF and ITU) and their initiatives of big data technologies with respect to the Sustainable Development Goals (SDGs) are also cited for a broader outlook. The intervention of the responsible organizations along with the respective governments is also much sought for encouraging the technology adoption across all the sections of the market players.

In this paper, intrusion detection systems are thoroughly investigated utilizing the CSE-CIC-IDS-2018 dataset. The research is divided into three key phases: first, applying Data Cleaning, Exploratory Data Analysis, and Data Normalization techniques (min-max and z-score) for preparing data across distinct classifiers. Second, feature importance is reduced using a combination of Principal Component Analysis (PCA) and Random Forest (RF), with the goal of improving processing speed and decreasing model complexity. This stage comprises a comparison with the entire dataset. Finally, machine learning algorithms (XGBoost, CART, DT, KNN, MLP, RF, LR, and Bayes) are applied to specific features and preprocessing approaches. Surprisingly, the XGBoost, DT, and RF models outperform in both ROC values and CPU runtime. Following evaluation, which includes PCA and RF feature selection, an optimal set is produced.

Since the advent of the Internet, there has been a significant shift from wired to wireless communication between devices. The volume of data transmitted has surged, primarily driven by the exponential growth of network services, Internet of Things (IoT) devices, and online users. This trend became especially pronounced with the onset of the COVID-19 pandemic, as the Internet's role and significance expanded dramatically. People began to spend more time online, engaging in activities like e-learning, remote work, and online shopping. Concurrently, concerns about the security of wireless communication channels have escalated. As more data is stored and transmitted over the Internet, cybercriminals are actively seeking unauthorized access to it to further their malicious objectives. Through a comprehensive literature review in the realm of wireless network security and privacy, it has become evident that several factors render these networks susceptible to vulnerabilities. The aim of this paper is to shed light on the major and common security and privacy challenges faced by existing wireless networks. Additionally, it seeks to demonstrate the array of techniques available to mitigate these issues. Ultimately, this paper will culminate in an in-depth analysis of cybersecurity measures to address the issues in wireless networks.

The ever-evolving landscape of technology continually drives the demand for more robust and secure systems. Intrusion Detection and Prevention Systems (IPS) play a pivotal role in safeguarding digital infrastructures. IPS harnesses a blend of cutting-edge technologies, specifically Network-Based, Wireless-Based, and Host-Based Intrusion Detection Systems (IDS), to fortify network security. This multifaceted approach enhances the system's capacity to scrutinize incoming data and network traffic, effectively reducing the risk of intrusion. In the realm of malicious activity detection, IPS employs a diverse array of techniques and mechanisms. Our proposed IPS integrates both anomaly-based and signature-based analysis approaches. In signature-based analysis, intrusions are identified by matching data collected from various activities with pre-defined signatures, employing rule-based methods to detect anomalies effectively. In the anomaly-based analysis approach, the system juxtaposes current activities with a baseline of normal behaviour to flag any deviations. This is achieved through distance-based methods, ensuring a well-rounded approach to threat detection. Our comprehensive prevention system encompasses a suite of security measures, including anti-virus software, Deep Packet Inspection, and Quarantine. These components work in synergy to detect and thwart malicious activities effectively. Even when concealed or hidden, the IPS remains a reliable sentinel, ensuring the integrity of your digital ecosystem. This review delves into the intricate web of terminologies and concepts surrounding Intrusion Detection and Prevention Systems, shedding light on the evolving technology landscape and the critical role IPS plays in bolstering cybersecurity.

This report covers the analysis of Intrusion Detection Systems nowadays. Therefore, it focuses on the IDS classification, which includes not only a well-known explanation of Network/Host-Based IDS type but also cloud-based solutions. The paper explores ways of intrusion detection, providing examples of the best detecting tools (OSSEC, Snort or Bro (ZEEK)). Another aspect covered in this report is the juxtaposition of three systems: IDS, IPS and IRS and their response. Finally, there will be presented Intrusion Detection Systems' evasion techniques and challenges, followed by critical conclusions.

: Cybersecurity has become a critical area in the digital field in recent years. The expansion of networks has revolutionised the way network structures are organised and managed. However, with increased connectivity and the growing complexity of modern networks, the threat of cyber-attacks has become more intense. As technology continues to advance, it brings both opportunities and challenges. One of the major challenges is the need to secure networks and sensitive data from various malicious activities. Traditional networks have evolved to include Software Defined Network (SDN), which offers a more flexible and programmable framework. Researchers should focus on detecting attacks in SDN because SDN networks are becoming more popular and attractive targets for clients due to their programmability and dynamic nature. The centralised controller, known as the backbone of an SDN, becomes a single point of failure and a potential target for attackers if not properly secured. Researchers need to emphasise the detection of attacks in SDN in order to mitigate these risks. By understanding the potential vulnerabilities and attack methods specific to SDN, researchers can develop effective detection approaches and propose countermeasures. This methodology helps protect the network from potential threats and minimises the impact of successful attacks. Therefore, this survey paper provides a review of Intrusion Detection Systems (IDSs) in Software-Defined Networks (SDN) to provide a thorough understanding of SDN security issues.

A single Information security is of pivotal concern for consistently streaming information over the widespread internetwork. The bottleneck flow of incoming and outgoing data traffic introduces the issue of malicious activities taken place by intruders, hackers and attackers in the form of authenticity desecration, gridlocking data traffic, vandalizing data and crashing the established network. The issue of emerging suspicious activities is managed by the domain of Intrusion Detection Systems (IDS). The IDS consistently monitors the network for identifica-tion of suspicious activities and generates alarm and indication in presence of malicious threats and worms. The performance of IDS is improved by using different signature based machine learning algorithms. In this paper, the performance of IDS model is determined using hybridization of nestrov-accelerated adaptive moment estimation –stochastic gradient descent (HNADAM-SDG) algorithm. The performance of the algorithm is compared with other classi-fication algorithms as logistic regression, ridge classifier and ensemble algorithm by adapting feature selection and optimization techniques