Publications

2022

1. 

   Analysis of Continual Learning Models for Intrusion Detection System

   Sai Prasath, Kamalakanta Sethi, Dinesh Mohanty, and 2 more authors

   IEEE Access, 2022

   Abs

   Deep Learning based Intrusion Detection Systems (IDSs) have received significant attention from the research community for their capability to handle modern-day security systems in large-scale networks. Despite their considerable improvement in performance over machine learning-based techniques and conventional statistical models, deep neural networks (DNN) suffer from catastrophic forgetting: the model forgets previously learned information when trained on newer data points. This vulnerability is specifically exaggerated in large scale systems due to the frequent changes in network architecture and behaviours, which leads to changes in data distribution and the introduction of zero-day attacks; this phenomenon is termed as covariate shift. Due to these constant changes in the data distribution, the DNN models will not be able to consistently perform at high accuracy and low false positive rate (FPR) rates without regular updates. However, before we update the DNN models, it is essential to understand the magnitude and nature of the drift in the data distribution. In this paper, to analyze the drift in data distribution, we propose an eight-stage statistics and machine learning guided implementation framework that objectively studies and quantifies the changes. Further, to handle the changes in data distribution, most IDS solutions collect the network packets and store them to retrain the DNN models periodically, but when the network’s size and complexity increase, those tasks become expensive. To efficiently solve this problem, we explore the potential of continual learning models to incrementally learn new data patterns while also retaining their previous knowledge. We perform an experimental and analytical study of advanced intrusion detection systems using three major continual learning approaches: learning without forgetting, experience replay, and dark experience replay on the NSL-KDD and the CICIDS 2017 dataset. Through extensive experimentation, we show that our continual learning models achieve improved accuracy and lower FPR rates when compared to the state-of-the-art works while also being able to incrementally learn newer data patterns. Finally, we highlight the drawbacks of traditional statistical and non-gradient based machine learning approaches in handling the covariate shift problem.

2. 

   Robust Federated Learning Models for Intrusion Detection Systems

   Sai Prasath, and Padmalochan Bera

   Indian Institute of Technology Bhubaneswar, 2022

   Abs

   Many industries today are increasingly adopting computerized systems to optimize their performance and increase their efficiency. The epicentre of this transformation has been the ability to leverage AI to analyze the large amounts of data generated by various systems for detecting attacks, forecasting demands, monitoring and controlling the system performance. With the ever-growing ability of AI models to perform at very high levels, many industries have been actively integrating their technologies with AI. One major drawback of AI systems is their need for large amounts of data, without which their performance is usually compromised. However, with growing concerns on the security and privacy of users, many companies worldwide are wary of sharing their system or customer information with any untrusted third party. Therefore, Traditional IDS systems that rely on centralized pooling of data and model training have suffered significantly from these security concerns. This research work proposes a Federated Learning-based IDS system capable of distributed training that ensures the security of the companies while at the same time being able to perform at high levels. We analyze the robustness of federated learning algorithms against Non-IID data, compromised clients, privacy invasions and model deployment attacks by empirically evaluating their accuracy levels on the NSLKDD dataset. Moreover, we study the advantages of using federated learning by comparing its performance with local self-training and traditional centralized training approaches. Further, we investigate various defense strategies including DQN based client selection, differential privacy, defensive distillation and adversarial training that will help secure the federated learning model against various attacks. Our results prove that FL models can achieve high-accuracy levels and robustness with minimal privacy concerns against most attacks with the help of the proposed defense strategies.

2021

1. 

   Intelligent Intrusion Detection System for Smart Grid Applications

   Dinesh Mohanty, Kamalakanta Sethi, Sai Prasath, and 2 more authors

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   Abs

   Smart grid is a cyber-physical system that enhances the capability of conventional power networks leveraging functional automation of information and communication technologies. These systems allow energy provider companies to deliver low cost reliable power with minimal losses. Despite the advantages, such cyber-physical systems are prone to heterogeneous attacks leading to a breach of data integrity and confidentiality. A significant part of the research that aims to tackle such weaknesses of the smart grids, suggests intrusion detection systems (IDS) as an effective solution. However, robustness, accuracy, and adaptability to new attacks are the major concerns in such systems. Therefore, we proposed an intelligent intrusion detection system for smart grid networks that uses deep reinforcement learning. Our proposed IDS is robust and highly accurate with low false alarm rate. Our model is based on the novel CVAEDDQN architecture, that combines generative model along with deep reinforcement learning. Due to lack of smart grid specific datasets, we have used benchmark network-based NSL-KDD dataset and cloud specific ISOT-CID dataset. The experimental results show the effectiveness of our proposed system in terms of accuracy and false positive rate as well as network attack detection capabilities. We have also evaluated the adaptiveness of our model with changes in attack patterns against critical attack types.