Traitement du Signal

Vol. 40, No. 3, June, 2023, pp. 905-914

Journal homepage: http://iieta.org/journals/ts

Embedded Signal Artificial Neural Network Based Intelligent Non-Dependent Feature

Selection for Cyber Attack Classification in Signal-Based Networks
Ragini Mokkapati* , Venkata Lakshmi Dasari

School of Computer Science and Engineering, VIT-AP University, Amaravathi 522237, Andhra Pradesh, India

Corresponding Author Email: [email protected]

https://doi.org/10.18280/ts.400307 ABSTRACT

Received: 16 November 2022 Signal-based cyber attacks pose a significant threat to the integrity, confidentiality, and
Accepted: 28 March 2023 availability of information systems. Intrusion Detection Systems (IDS) monitor network and
system activities for malicious activity or policy breaches, which are then reported to a
Keywords: management station. Due to the high volume of network traffic in cyber networks, real-time
signal based cyber attacks, network threat detection is often computationally infeasible. In this study, we explore the use of an
security, feature extraction, feature Artificial Neural Network (ANN) for cyber network threat identification, specifically
selection, redundancy, feature subset focusing on its application in nonlinear characteristics and network security domains. Data
reduction is crucial for achieving real-time detection in a Signal-based Cyber Attack
Detection Model (SCADM). However, traditional CADMs analyze all data features to detect
patterns of intrusion or misuse, leading to redundancy in detection features. The primary
objective of this research is to identify computationally efficient and effective input features
for SCADM. We propose an embedded Signal with ANN-based Intelligent Non-Dependent
Feature Selection Model (ANN-INDFSM) that effectively extracts signal-based cyber attack
features and performs feature reduction for accurate detection of signal-based cyber attacks
while maintaining security. The ANN-based feature selection method was employed for
eliminating non-salient features and determining dimensionality levels. Given the diverse
characteristics and pattern types of emerging cyber attacks, tracking them has become
increasingly challenging. Various methods have been used for feature extraction and
selection, with the ultimate goal of detecting anomalies in large cyber security datasets.
Although this process is both time-consuming and computationally demanding, the
efficiency of machine learning algorithms can be improved by removing unnecessary and
redundant features. Feature selection (FS) serves as one such method. By utilizing datasets
containing only a sufficient subset of features instead of the full dataset, the computational
time required for attack detection algorithms can be reduced. When compared to existing
models, the proposed ANN-INDFSM demonstrates optimized performance levels,
providing a streamlined and effective solution for the detection of cyber attacks in signal-
based networks.

1. INTRODUCTION analyses this knowledge and partitions it into regular &

harmful activities, present the result to network administrator
With the exponential growth of the internet, data security [5]. Due to its limitations in scalability, adaptability, and
has become an increasingly pressing issue. Security refers to veracity, data mining finds its most widespread application in
how well a system or network is protected from attacks. The IDS [6]. Info sources for IDS include network logs, host data,
three pillars of information security are privacy, data integrity, and more. Data analysis is challenging because of the volume
and data availability [1]. The term intrusion is commonly used of network traffic. This necessitates combining IDS with
to describe network attacks. Intrusion refers to any concerted various data mining methods for intrusion detection [7].
effort to breach information security measures [2]. Anomaly Cyberattacks pose legitimate safety concerns, necessitating
detection is one of major information security concerns. the development of a cutting-edge, malleable, and remarkably
Intrusion Detection Systems (IDS) help computers fend off effective IDS [8]. An IDS is a framework or method used to
malicious intrusion attempts. Network security has come a detect and differentiate intrusions, attacks, invasions, or
long way from its early days, when only traditional methods breaches of the safety schemes autonomously at the network
like encryption, firewalls, VPNs, etc. were used. It is level and the host level. Network-based intrusion detection
impossible to depend fully on static protection measures. This systems (NIDS) and host-based intrusion detection systems
increases the necessity of dynamic technique, which may (HIDS) are two types of security infrastructure that classify
check network nodes and identify illegal activities in the attacks based on their characteristics [9]. If the architecture is
network [3]. Thus to strengthen the security protocols dynamic based on network behaviours, it is known as a NIDS. By
technique is proposed and termed as Intrusion Detection duplicating the actions of networking equipment like switch,
Systems [4]. Intrusion detection system takes online data routers, and network taps, network tools collect data that can
collected from the network then after that observes and be used to identify assaults and other threats hiding in network

905
traffic [10]. The term HIDS refers to a framework that uses actions that could compromise a system's integrity and
system workouts in the form of multiple log data acquisition performance. Differentiating between benign and malicious
on the local host machine or device to discover malware. network activity is difficult in intrusion detection [21]. A
These logs are being fetched locally, using sensors of various machine learning algorithm is used in conjunction with feature
kinds. In contrast to HIDS's reliance on data from log selection algorithms to establish which feature set that yield
documents, which may include sensor logs, event logs, the most significant improvements in accuracy and
application logs, file systems, disc assets, client account details, computational processing times [22]. The generated matrix
and a few other elements of each system, NIDS analyses every gives users a heuristic for determining which based on deep
packet of data relied upon within network traffic streams. In learning.
some establishments, HIDS and NIDS are used together [11]. IDS development has recently benefited from the
The first line of defense against a security breach is a application of Artificial Neural Networks (ANN) [23]. ANN's
reliable intrusion detection system. Thus, there has been a lot intrinsic speed and the ease with which nonlinear relationships
of focus on security solutions like firewalls, IDSs, UTMs, and between input and output can be represented are two of its
IPSs. By collecting data from a wide range of systems and greatest strengths. Incomplete or skewed data wouldn't stop a
networks and then analysing it, intrusion detection systems can neural network from processing it [24]. An issue with neural
identify potential security breaches and stop them in their network-based methods is that they struggle to understand the
tracks. The packet data that traverse a network are analysed in input-output relationship when the input data has a high
two ways by a network based IDS [12]. The issues with dimensionality [25]. The primary benefits of ANNs over
anomaly based intrusion detection are that it needs to cope conventional IDSs lie in their enhanced capacities for learning,
with unique attack in which there is no previous experience to classification, rapid data processing, and self-organization.
identify the anomaly [13]. This means that anomaly - based Because of these benefits, Neural Networks can enhance IDS
intrusion detection is still a key topic for research. For this performance [26], and AI methods can boost IDS/IPS potency.
reason, experts have been looking at machine learning The ANN process in analyzing and generating the output is
methods for the past several years in the hopes of giving the shown in Figure 2.
system the ability to tell good traffic from bad or to spot
anomalies [14]. The IDS model is shown in Figure 1.

Figure 2. Artificial neural networks

Advanced IDSs are defined as host-based or network-based

computer programs that monitor their surroundings and
behave flexibly to improve detection accuracy [27]. These
Figure 1. Intrusion detection system programs determine what must be done in an environment by
learning that setting and then applying inference rules to the
When mining enormous datasets, feature selection is an data. A smart IDS can make decisions and validate constraints.
essential pre-processing step that can dramatically boost the Most intelligent systems either utilize rules to make decisions
overall system's performance [15]. The final feature subset is or agents to do so. As a result of proposing smart methods for
generated by the wrapper phase, and the filter phase chooses preprocessing and efficient categorization [28], smart
the features with the maximum information gain and directs intrusion prevention systems have been developed. When
the start of the search procedure for that phase [16]. Feature compared to other methods, the detection rate offered by such
selection's ultimate goal is to narrow down a large pool of IDSs is superior. In order to acquire a subset of attributes that
candidate features to just those that adequately characterise the accurately characterise the given problem with a minimal loss
target notion. In both theoretical and practical settings, it has of performance, extraction of features involves identifying the
been shown to improve learning efficiency, boost predictive relevant characteristics and rejecting the unnecessary ones
accuracy [17], and decrease result complexity [18]. The search [29]. There are many benefits to doing so, including enhancing
space for the best possible feature selection is exponential in the efficiency of machine learning algorithms, better
E, where E is the number of features. So, it could be comprehending data, learning more about the process through
excessively expensive and impracticable [19]. The wrapper better visualisation, reducing data size, lowering storage needs,
model differs from the filter model in that feature selection and cutting down on processing expenses.
does not rely on a learning process. The filter model's strengths In classification, a classifier is trained from a training set of
lay in its superior generalizability and cheap computational labelled data instances, and then used to categorize a training
cost, both of which are independent of the learning algorithms set into one of the groups in testing. A classifier is learned
used [20]. The goal of intrusion detection is to uncover illegal during the training phase by ingesting the available labelled

906
training data [30]. In the testing phase, the classifier is used to Wi-Fi Intrusion Dataset, the most popular dataset for Wi-Fi
determine whether a test case is typical or out of the ordinary. intrusions, the suggested model (AWID2) is tested.
Intrusion detection methods that rely on classification can be In order to automatically and quickly identify and
run with a single-class classifier or several classes. IDS categorize network and host-level signal based cyber attacks,
methods based on uni class classifications presume that each supervised learning techniques are frequently employed in the
training case has a unique class label. These methods use a development of IDS. Malicious assaults provide a number of
one-class classification method to learn a racially difficulties, however, because they are dynamic and happen in
discriminatory boundary around the typical examples. Any high volumes, necessitating a scalable response. The cyber
data sample that fails to fit the boundary established by the security community can access a variety of publicly available
learning process is flagged as abnormal. In this research, an malware datasets to do additional study. However, there is
effective ANN based intellectual non dependant feature currently no research that compares and contrasts the efficacy
selection model is proposed that effectively extracts the signal of different machine learning algorithms using a wide range of
based cyber attack features and performs feature reduction for publicly available datasets. Since malware is always evolving
accurate detection of signal based cyber attacks to maintain and using new attack vectors, it is important to regularly
security. The proposed model feature dimensionality update and benchmark publically available malware datasets.
reduction reduces the features selected for intrusion detection. Vinaya kumar et al. [5] investigated the use of a deep learning
The independent features are only considered for training the model (DNN), a form of learning algorithm, to build a robust
ANN model that accurately detects the intrusions. The IDS that can identify and categorise signal based cyber attacks
proposed model performs the memory optimization with the that cannot be predicted in advance. The need to evaluate
reduced feature set and also the time complexity levels are diverse datasets collected over the years using static and
very much reduced than the traditional models. dynamic methods is a direct result of the dynamic nature of
network behaviour and the quick growth of attacks. Research
of this nature helps pinpoint the most efficient system for
2. LITERATURE REVIEW spotting future cyber attacks. Extensive studies comparing
DNNs and other classical learning techniques classifiers on
Concerns over security and privacy have been sparked by many available to the public benchmark malware datasets are
the rapidly growing number of linked computing devices, the presented, along with a detailed evaluation of the results.
prevalence of wireless networking, and the inclusion of cyber- KDDCup 99 dataset is used in this model and the hyper -
physical-social systems. Recent years have seen the parameters selection techniques are analyzed to determine the
incorporation of machine learning (ML) techniques into the best possible network parameters and topologies for DNNs.
creation of IDS, which are widely regarded as a very efficient The proliferation of IoT devices has led to an increase in
kind of defence. Traditional ML-based IDS, which cybercrime and highlights the need for better network and
necessitates considerable computing resources such as system protections. With the proliferation of IoT devices and
restricted energy source, computational power, and memory, services, cyber security has emerged as a complex subject to
is not suited for running on Internet of Things (IoT) devices. oversee. Today's network intrusion detection solutions rely
Therefore, the goal of this research is to create a small ML- heavily on deep learning-based signatures of malicious traffic
based IDS that is optimised for low-powered gadgets. In IDS. Intrusion detection in networks has been a topic of deep
particular, IM-Personation Attack detection using the deep learning methodology. An RNN has several potential uses.
auto-encoder and feature-abstraction (IMPACT), a The first contribution of this research made by Ullah et al. [6]
lightweight machine learning (ML)-based intrusion detection is a unique deep learning model for abnormal identification in
system, is proposed by Lee et al. [2]. Using a stacked IoT networks by means of a recurrent neural networks. The
autoencoder (SAE) and a C4.8 wrapper, we can reduce the suggested model for IoT network anomaly detection is
number of features for deployment and execution on resource- implemented utilizing Long Short Term Memories (LSTM),
constrained devices based on deep features training and Bi-LSTM, and Gated-Recurrent Units (GRU) methods. When
gradient-based Support Vector Machines (SVM). In order to it comes to feature learning, CNNs shine because of their
spot impersonation attacks, the IMPACT has been trained on ability to examine input features without discarding any
the Aegean Wi-Fi Hacking Dataset (AWID). relevant information. The author then devised a
The proliferation of wirelessly connected gadgets has both convolutional/recurrent neural network hybrid model for deep
beneficial and undesirable outcomes. While it facilitates a learning. The author concluded by proposing a minimal deep
wide variety of human activities, the wireless nature of the learning approach for classification that makes use of LSTM,
medium makes the system susceptible to attack. Using cutting- Bi-LSTM, and GRU based techniques. The NSL-KDD, BoT-
edge anomaly detection methods, an IDS may monitor IoT, IoT-NI, IoT-23, MQTT, MQTT-set, & Connectivity
network traffic for signs of intrusion. It has been possible to datasets are used to test the accuracy of the proposed deep
tell good traffic from bad using deep learning models. A major learning models. The suggested classification and binary
obstacle to using machine learning for IDS has been classification method outperformed state-of-the-art deep
translating tables into images prior to image classification. learning implementations in terms of precisions, re-call, and
New tabular data projection into 2-coded colour mapping is F1 score.
proposed for IDS applications. In order to achieve desirable Power system reliability depends on accurate and prompt
dimensionality, the suggested approach uses a feature reactions to abnormal conditions. It is crucial to provide an
selection technique proposed by Aminanto et al. [3]. To accurate method for the categorization of activities and
determine how the traits are related to one another, the author abnormalities in the power grid so that the operators or the
analysed groups of attributes with varying sizes. To further automated reply system can take timely action during system
categorise Wi-Fi attacks, it employs a model based on crises. In order to develop dataset for event and intrusion, the
Convolutional Neural Networks (CNNs). Using the Aegean humongous amounts of moment data generated by the phasor

907
measuring devices can be merged with logs from those other Despite PNN's somewhat longer runtime compared to the
elements in the power grid. In order to better categorize GRNN strategy, users can confidently declare it to be the best
emergencies and signal based cyber attacks, Hong et al. [9] choice for data with the achievable trade-off between
presented the outcomes of implementing deep learning performance and runtime.
techniques to open dataset acquired from a power grid testbed. Industrial Control Mechanisms (ICMs) are made far more
Three distinct recurrent neural network (RNN) architectures susceptible to signal based cyber attacks due to their
are explored and evaluated for their ability to classify events incorporation of communications systems and IoT, with
into binary and multiclass categories. potentially catastrophic results. Classical IDSs rely heavily on
Due to the exponential increase in complex and an ever predetermined models and are primarily trained on certain
cyber threats and attacks, the entire IoT infrastructure is in cyber-attacks; they are primarily designed to support IT
disarray. The IoT is part of the infrastructure of connected systems. Furthermore, many IDSs do not take into account the
devices, which presents serious security concerns. The asymmetrical character of ICS datasets, leading to poor
primary focus of cyber threat analysis is the identification and precision and a high rate of false positives when deployed. In
prevention of complex network-based threats and attacks, this research, Al-Abassi et al. [16] suggested a deep learning
making it an integral part of any network security approach to create novel representations of an imbalanced
infrastructure. It also necessitates the network security dataset that are more fair. With these updated representations,
provided by the examination and categorization of malicious a deep learning detection and prevention model tailored to an
actions. In this research, Qureshi et al. [10] introduced a DL- ICS setting may be trained. The suggested attack detection
enabled spyware detection scheme that makes use of a hybrid model makes use of Deep-Neural-Network (DNN) and
methodology based on the coupling of a DNN with Long Decision-Tree (DT) classifiers to spot signal based cyber
Short-Term Memory (LSTM) for the important instructional attacks using these updated models of data. Ten-fold cross-
of multi-class malware attacks in IoT infrastructure. validation on two independent real-world ICS datasets is used
Cyber-Physical Systems (CPS) such as those used to to assess the quality of the proposed model.
regulate transportation, manufacturing, and utilities frequently Artificial intelligence and smart approaches have been
employ deep neural networks (DNNs). DNNs, however, are implemented, and have become hotly discussed subjects in
susceptible to attacks from what are known as adversarial industrial cyber-physical systems, in tandem with the growth
examples, which are carefully crafted input samples. One of of the Industry 4.0 [19]. While there has been progress in the
the most useful tools for discovering vulnerabilities in neural field of cyber-physical security protection, intelligent anomaly
networks and fixing them is the adversarial attack. To gain the detection for recognizing cyber-physical threats to ensure the
direction of creating adversarial samples, existing methods, efficiency and safety of the workplace is still a hard issue. To
such as the state-of-the-art black-box attack, create faulty solve the over-fitting problem and improve the precision of
queries with a reduced success rate. Kuang et al. [13] intelligence anomaly detection in industrial CPS, Zhou et al.
presented an adversarial approach on black-box DNNs using a [19] presented a few-shot learning model using a Siam
CMA-ES. In the first place, a powerful strategy for decreasing convolutional neural network (FSL-SCNN). Using optimal
the quantity of bad requests is shown. Second, the author feature representations, distances between input samples can
suggested a black-box assault wherein adversarial samples are be calculated using a Siam CNN encoding network. To further
generated automatically to match a high-dimensional- improve the training process's efficacy, a strong cost function
independent Gaussian-distribution of the local optimal design is then provided, one that takes into account three
solution. In order to make the procedure of perturbation distinct losses. Finally, a smart anomaly-detection algorithm
reduction more seamless, a novel CMA-based perturbations has been created.
compression method is employed.
The internet is expanding rapidly, with numerous web-
based apps to meet the varied requirements of today's 3. PROPOSED METHODOLOGY
consumers. However, the widespread adoption of online
services has opened them up to significant vulnerabilities in It is of interest to utilize statistical modeling via
terms of data safety and dependability. Cyber threats, on the computational means to forecast whether unseen observations
other hand, have evolved alongside technical progress, are signal based cyber attacks and the intensity of those attacks
blending formerly separate attack vectors into increasingly based on data from controlled cyber threat and intrusion
complex and dangerous wholes. Since both the frequency and exercises, which is essentially participatory simulation. Cyber
sophistication of signal based cyber attacks are only expected anomaly and threat detection is a topic of intense research
to rise, it is critical that strengthening of defences against them interest nevertheless, doing so requires analyzing a massive
is performed. This study's goal is to evaluate competing neural amount of data. This would be a Big Data challenge with high
network models for their ability to identify harmful from data velocity in a real-time setting. In order to enhance
benign behavior that is analyzed by Albahar et al. [15]. Two response time and data storage, it is necessary to identify a
datasets are used to train, validate, and test the models under smaller selection of important data elements to monitor.
scrutiny. The confusion matrix is used to evaluate the accuracy Therefore, this research primary objective is to develop a
of the models under scrutiny. Binary categorization and multi- dimensionality reduction model for cyber security, one that
class categorization are used to assess the models for the ranks and identifies the most important traits for threat
cyber-physical subsystems dataset. Since the KDD dataset identification. It will be achieved via the creation and
only has two categories—regular and harmful, a binary implementation of a feature dimensionality reduction strategy
classification method is required. When comparing binary based on classifiers.
classification to multi-class classification, the outcomes are Although linear discriminant analysis has been used in
often more promising for binary classification. PNN models previous cyber security studies to account for error when
have the best results, while GRNN models are the quickest. evaluating the importance of individual characteristics, this

908
factor was not taken into account when deciding how many based cyber attack features and performs feature reduction for
features to utilize for classification. In this research, an end-to- accurate detection of signal based cyber attacks to maintain
end methodology is established for identifying signal based security.
cyber attacks using feature extraction from network traffic
data and subsequent feature selection using classifier-based Algorithm ANN-INDFSM:
algorithms. While ANNs have been used for cyber intrusion
detection before they have not yet been used to estimate the do
importance of cyber features. Classifier models based on
ANNs are utilized to identify relevant information for threat Input: Intrusion Detection Dataset {INDTSET}
detection. This technique is used to provide insight into what
data is most relevant for detecting signal based cyber attacks Output: Intrusion Prediction List {IPL}
by combining the classification and feature relevance ranking
tasks. The intrusion detection dataset is considered and the data
Feature selection is crucial in the detection of signal based set undergoes pre processing. The term data preparation refers
cyber attacks. It has been demonstrated that learning to the steps used to clean and organize data before it is
algorithms' efficacy might be negatively impacted by analyzed. Since raw data is not used for analyzing, the pre
redundant and/or irrelevant features. There is currently no processing process is equally crucial for machine learning. The
accessible automatic and efficient feature selection approach pre processing is performed as
that can help capture the primary properties of the data across
𝑀
a variety of operational settings. Conventional forward feature
selection based on feature ranking is commonly employed in 𝐷𝑇𝑆𝐸𝑇 = ∑ 𝑔𝑒𝑡𝑉(𝑖) + 𝑎𝑣𝑔𝑉(𝑀 − 𝑖, 𝑖) − 𝐺(𝑖)
data processing. Gain in knowledge is a popular statistic used 𝑖=1
to rank characteristics. Information gain has one major
drawback: it requires joint probability distribution functions of 𝑀𝑎𝑥(𝐷𝑇𝑠𝑒𝑡 (𝑖 + 1)) − 𝐺(𝑖)
𝐼𝑁𝐷𝑇𝑆𝐸𝑇 =
characteristics and target classes. Training data is typically
used to get the necessary information to learn these functions. √∑𝑀
𝑖=1(max(𝐷𝑇𝑠𝑒𝑡 (𝑖 + 1))) − min⁡(𝐷𝑇𝑠𝑒𝑡 (𝑖))
When there are many classes and features to choose from, the + 𝑇(𝑖)
learning process slows down. In addition, if the sample sizes
of the various classes are not roughly equal, the estimation will Here G is the function that extracts the special symbols in
be off. the dataset. avgV() function is used to find the mean average
Convolutional, pooling, and fully connected layers make up value for every 2 records in the dataset. The removed values
convolutional neural network (CNN) architecture that is are filled with the threshold value T in the cleaned dataset.
applied on this research. The three layers that make up CNN After cleaning the data, the features are extracted from the
are the convolutional layer, the pooling layer, and the fully dataset to initiate the training of the model. The features of the
connected layer. This group of neural networks is used to dataset are completely extracted where the process is
analyse information using a grid structure. In a CNN, the performed as
convolution layer performs the bulk of the processing. After
applying K filters towards the input volume, K 2-dimensional FSet(INDTSET (r))
activation maps are generated. The output volume is the result max(𝐼𝑁𝐷𝑇𝑆𝐸𝑇 )
=
of stacking K activation maps all along hidden layers of len(𝐼𝑁𝐷𝑇𝑆𝐸𝑇 )
intrusion data records. The fully connected (FC) layer couples M
every input to every neuron in the network. After that, the ∗ ∑ len(G) + (maxValue(𝑖 + 1)
squished vector travels through some more FC layers, which i=1
is often where the mathematical functions operations are minValue(i)
carried out. At this stage, the process of categorising the data − )
2
is performed as normal or intrusion. If a CNN design includes
an FC layer, it is usually the last layer in the network that + [∑ 𝑚𝑒𝑎𝑛(𝑖 + 1)
predicts the intrusions in the network. 𝑖=1
It is possible to keep monitoring on the entire network 𝑚𝑎𝑥𝑉𝑎𝑙(𝑖) − 𝑚𝑖𝑛𝑉𝑎𝑙(𝑖 − 1)
because the IDS module is installed on the network IDS. By + ]
𝑐𝑜𝑢𝑛𝑡(𝑖)
scanning all data packets that traverse the network, this
Intrusion Detection System can uncover any suspicious The features extracted are considered for allocation of
behavior. That is because the IDS host installs its module on weights. The weights are allocated based on the features
every client in the network. Selecting and ranking features is a dependency and non dependency levels. The weight allocation
crucial challenge in intrusion detection. Eliminating process is performed as
unnecessary features improves IDS performance by increasing
detection accuracy and reducing computation time. The 𝑊𝑒𝐹𝑠𝑒𝑡(𝐹𝑆𝑒𝑡[𝑀])
effectiveness of the learning algorithm is affected by the
uniqueness of the features and the number of features used
during training. Selecting suitable training settings and a = ∑ ∑ max (𝐹𝑠𝑒𝑡(𝑔𝑒𝑡𝑉𝑎𝑙𝑢𝑒(𝑖)))
𝑗=𝑖+1
strong subset of features are crucial concerns for enhancing the
𝑖=1
IDS's accuracy and overall performance. In this research, an
effective ANN based Intellectual Non Dependant Feature − min⁡(𝐹𝑠𝑒𝑡(𝑔𝑒𝑡𝑉𝑎𝑙𝑢𝑒(𝑗)))
Selection Model is proposed that effectively extracts the signal + log ( max Fset(i) + simm(i, j))
1≤i,j≤M

909
 Here WeFset is the set that contains weights that are 𝐻𝐿𝑎𝑦𝑒𝑟(𝐼, 𝑂, 𝐹, 𝐿)
allocated to the features. Each features is allocated a weight 𝑀
min⁡(𝑊𝑒𝐹𝑠𝑒𝑡(𝐹(𝑗)))
based on the correlation value. = ∑ max(𝑊𝑒𝐹𝑠𝑒𝑡(𝐹(𝑖))) −
The non dependant feature selection process is performed to L
𝑖=1,𝑗=𝑖+1
generate the final feature subset. The feature subset features ∗ 𝑐𝑜𝑢𝑛𝑡(𝐹𝑆𝑒𝑡)
will be used to train the models. Instead of considering all max(𝐹(𝑖 + 1, 𝑗 + 1)) + ∑𝑀
𝑗=𝑗+1 max⁡(𝑊𝑒𝐹𝑠𝑒𝑡(𝐹(𝑗 + 1)))
features, the feature subset will consider the best and most +
min⁡(𝑊𝑒𝐹𝑠𝑒𝑡(𝐹(𝑗 − 1)))
useful features for the intrusion detection model. The proposed
model framework is shown in Figure 3. +𝑇
An artificial neural network is a network in which
computational elements or neurons are connected in a Here I is the input, O is the output, F is the features allocated
predetermined structure. It can generalize from sparse, with weights and L is the length of the features selected.
imperfect data and learn from examples. ANN has been used Each neuron in this network receives input from M different
well in many types of data-heavy programs. An input layer, sources, and the weights assigned to these sources add up to a
several hidden layers, and a output layer make up a neural total. Bi is the bias value that is multiplied by the activation
network. An equal number of neurons can be found in each function's input. First, we define the inputs to a neuron as B1,
successive layer. A neural network receives data at its input B2, B3,..., BM, the weights as We1, We2, We3,..., WeM, the
layer, processes it at its hidden layers, and returns the result at bias as Bi, and the output of the neuron as O, where an is the
its output layer. Figure 4 depicts a common type of neural result of solving for B. where F is the activation function
network model that includes a hidden layer. utilized to obtain the layer's output for use as input to the
following layer. An artificial neural network consists of nodes
and weights that must be learned based on the existing patterns.
The activation function and the hidden layer analysis and
output generation of final feature subset is performed as
𝑀

𝑎𝐹 = 𝐹(∑ 𝑊𝑒𝑖 ∗ 𝐼𝑖 + 𝐵𝑖 )
𝑖=0

𝑎𝐹 is the activation function applied on feature subset.

The final feature subset is used for intrusion detection in the
cyber network. The intrusions are detected and the prediction
list is generated that indicates nodes causing intrusions in the
network. The prediction list is generated as

𝑃𝑟𝑒𝑑𝑆𝑒𝑡(𝑊𝑒𝐹𝑠𝑒𝑡[𝑀])
Figure 3. Proposed model framework = max (𝐻𝐿𝑎𝑦𝑒𝑟(𝐹𝑆𝑒𝑡(𝑖)))
max(aF(i))
−∑ ∗ Bi
min(Ii )
𝑖=1
+ min⁡(HLayer(Fset(i + 1)))

Done

4. RESULTS

Over the past decade, signal based cyber attacks have

evolved into a major problem. There have been a number of
attempts to develop ways for detecting signal based cyber
attacks, each with varying degrees of success. In this research,
Figure 4. Neural network model a new feature selection approach for detecting and classifying
signal based cyber attacks in a distributed setting is proposed.
In order to increase accuracy level, a deep learning model is The network's regular state and the various attack kinds are
employed with layers representing features for intrusion both represented as distinct data classes. The proposed
detection. Weighted features are divided by a permutation technique generates a set of pairwise feature subsets, selected
layer by estimating the presence of the layer. If extracted for discriminating that class from each of the other classes, for
feature mappings sets like map D and map E are created by each local binary classifier. This is in contrast to typical feature
summing their convolutions, various convolution kernels can selection methods, which choose a distinct feature subset for
be identified. It is standard procedure to input the attributes, each local binary classifier. It is demonstrated that the new
add up the weighted features to make the final prediction set. feature selection strategy is superior in its ability to choose all
The hidden layer processing is performed by providing the pertinent features, leading to enhanced detection and
required inputs and the process is performed as: classification precision.
In this research, an effective ANN based Intellectual Non

910
Dependant Feature Selection Model (ANN-INDFSM) is
proposed that effectively extracts the signal based cyber attack
features and performs feature reduction for accurate detection
of signal based cyber attacks to maintain security. The
proposed model is implemented in python and executed in
Google Colab.
The dataset is considered from publicly available dataset
provider kaggle with the link
https://www.kaggle.com/datasets/sampadab17/network-
intrusion-detection. The dataset containd 125674 records in
which the dataset is divided into training and testing purposes
in the ratio 80:20. The dataset for the audit was provided, and
it contains many different types of simulated intrusions in a
military network. It simulated a common US Air Force LAN Figure 6. Feature extraction time levels
to provide a setting for collecting raw TCP/IP dump data from
a network. Several simultaneous attacks were directed at the When considering features, it is common practice to give
Network to make it feel more like a real world scenario. Data each feature a varied amount of weight in the overall feature
travels from a source IP address to a destination IP address in set. The feature weights are allocated for each feature based on
accordance with a predefined protocol over the course of a the correlation value. The feature weight allocation accuracy
connection, which is specified as a sequence of TCP packets levels of the proposed and traditional models are shown in
beginning and ending at a certain time period. The proposed Figure 7.
model is compared with the traditional hybrid intrusion
detection system based on a CFS-DE feature selection
algorithm (HIDS-CFS-DE-FSA) [1]. The results represent that
the proposed model performance in feature subset generation
is high.
The choice of features is a crucial step in developing IDS.
The term feature extraction is used to describe the procedure
of converting unstructured data into a set of quantifiable
features that may be further processed without losing any of
the original data's contexts. In order to reduce the size of a
dataset, feature extraction typically involves the generation of
additional features from preexisting ones. As a result, this new,
smaller set of features should be able to effectively describe
the original set of features. The feature extraction accuracy
levels of the existing and proposed models are shown in Figure
Figure 7. Feature weight allocation accuracy levels
5.
Feature Selection is a technique for narrowing down the
data used in proposed model by keeping only the most
pertinent information and discarding irrelevant details. A
subset generation method is a search method that uses certain
search strategies as a sequential search to pick feature subsets.
Feature selection, also known as spatial selection, attribute
selection, or variable subset selection, is a technique used in
machine learning and statistics to narrow down a large pool of
potential features to a manageable subset of useful variables
and predictors. The Figure 8 shows the Non Dependant
Feature Selection Model Time in milliseconds Levels of the
traditional and proposed models.

Figure 5. Feature extraction accuracy levels

Feature extraction is used to learn new features from the

existing data set in order to discover relevant features in the
data. By linearly combining the preexisting features, the
feature extraction method provides us with a set of brand new
features. All of the values for the new set of features will be
different from the old set. The ultimate goal is to reduce the
number of features necessary to adequately represent a
problem space. The feature extraction time levels in
milliseconds of the proposed and traditional models are shown
in Figure 6.
Figure 8. Non dependant feature selection model time levels

911
 Figure 9. Non dependant feature selection model accuracy Figure 11. Intrusion detection accuracy levels
levels

Feature subset selection involves finding and discarding as 5. CONCLUSION

much superfluous data as feasible. As a result, learning
algorithms can function with greater efficiency and speed up The Internet's popularity and the number of connected
the reduced dimensionality of the data. Feature Selection is a devices are expanding at a lightning rate as a direct result of
technique for narrowing down the data used in the model by the exponential development of technology. There has been a
keeping only the most pertinent information and discarding rise in the amount and heightened risk of network traffic as a
irrelevant details. The Figure 9 represents the Non Dependant result of this development. Learning intrusion detection
Feature Selection Model Accuracy Levels of the existing and systems have been developed with the goal of discovering
proposed models. previously unknown and complex attacks. Machine learning-
When a legitimate action is misidentified as malicious by based models are widely used in intrusion detection systems
IDS, this is known as a false positive or false alarm. One due to their high accuracy and speed. In today's technology
definition of a false positive is an unwarranted positive result. world, where more and more people rely on electronic and
The most severe and potentially harmful state is a false digital technologies, protecting their privacy and security
negative state. This happens when an attack is actually being online has become a hot concern. As a result, cyber security
carried out but is mistakenly labelled as acceptable by the IDS. researchers are always looking for novel and effective
The false alarm rate levels of the existing and proposed models methods to combat online threats. An IDS is designed to ward
are shown in Figure 10. off hacking attempts on a computer or network. In other words,
it lessens the chances of harm occurring to a system from
outside sources. Classifying design models by the feature
reduction techniques they employ facilitates analysis. The
results suggest that by paying close attention to the feature
selection approach, the classifier's prediction performance
may be enhanced in terms of high detection rate and accuracy,
low false alarm rate, and shorter training and testing times. In
this research, an effective ANN based Intellectual Non
Dependant Feature Selection Model is proposed that
effectively extracts the signal based cyber attack features and
performs feature reduction for accurate detection of signal
based cyber attacks to maintain security. The proposed model
achieves 97% accuracy level in detecting intrusions. In future,
the model can be optimized by applying hybrid optimizations
models and the training samples can also be increased that
Figure 10. False alarms rate levels further improves the detection rate.

In order to detect and counteract malicious activities, a

network intrusion detection system is essential. An intrusion REFERENCES
detection system's main benefit is that it may alert system
administrators if there is a chance that an intrusion is taking [1] Zhao, R., Mu, Y., Zou, L., Wen, X. (2022). A hybrid
place in the network. An intrusion detection system can be intrusion detection system based on feature selection and
used to examine both the frequency and nature of attacks. As weighted stacking classifier. IEEE Access, 10: 71414-
a result of this data, businesses will be able to improve their 71426. https://doi.org/10.1109/ACCESS.2022.3186975
security measures. Businesses can also benefit from intrusion [2] Lee, S.J., Yoo, P.D., Asyhari, A.T., Jhi, Y., Chermak, L.,
detection systems by fixing configuration errors and spotting Yeun, C.Y., Taha, K. (2020). IMPACT: Impersonation
flaws in their network devices. The Intrusion Detection attack detection via edge computing using deep
Accuracy Levels of the existing and proposed models are autoencoder and feature abstraction. IEEE Access, 8:
shown in Figure 11. 65520-65529.
https://doi.org/10.1109/ACCESS.2020.2985089

912
[3] Aminanto, M.E., Wicaksono, R.S.H., Aminanto, A.E., using different neural network-based models. IEEE
Tanuwidjaja, H.C., Yola, L., Kim, K. (2022). Multi-class Access, 8: 61549-61564.
intrusion detection using two-channel color mapping in https://doi.org/10.1109/ACCESS.2020.2984157
IEEE 802.11 wireless Network. IEEE Access, 10: 36791- [16] Al-Abassi, A., Karimipour, H., Dehghantanha, A., Parizi,
36801. https://doi.org/10.1109/ACCESS.2022.3164104 R.M. (2020). An ensemble deep learning-based cyber-
[4] Saharkhizan, M., Azmoodeh, A., Dehghantanha, A., attack detection in industrial control system. IEEE
Choo, K.K.R., Parizi, R.M. (2020). An ensemble of deep Access, 8: 83965-83973.
recurrent neural networks for detecting IoT cyber attacks https://doi.org/10.1109/ACCESS.2020.2992249
using network traffic. IEEE Internet of Things Journal, [17] Zhu, J., Jang-Jaccard, J., Watters, P.A. (2020). Multi-loss
7(9): 8852- Siamese neural network with batch normalization layer
8859.https://doi.org/10.1109/JIOT.2020.2996425 for malware detection. IEEE Access, 8: 171542-171550.
[5] Vinayakumar, R., Alazab, M., Soman, K.P., https://doi.org/10.1109/ACCESS.2020.3024991
Poornachandran, P., Al-Nemrat, A., Venkatraman, S. [18] Pasetti, M., Ferrari, P., Bellagente, P., Sisinni, E., de Sá,
(2019). Deep learning approach for intelligent intrusion A.O., do Prado, C.B., David, R.P., Machado, R.C.S.
detection system. IEEE Access, 7: 41525-41550. (2021). Artificial neural network-based stealth attack on
https://doi.org/10.1109/ACCESS.2019.2895334 battery energy storage systems. IEEE Transactions on
[6] Ullah, I., Mahmoud, Q.H. (2022). Design and Smart Grid, 12(6): 5310-5321.
development of RNN anomaly detection model for IoT https://doi.org/10.1109/TSG.2021.3102833
networks. IEEE Access, 10: 62722-62750. [19] Zhou, X., Liang, W., Shimizu, S., Ma, J., Jin, Q. (2020).
https://doi.org/10.1109/ACCESS.2022.3176317 Siamese neural network based few-shot learning for
[7] Li, Z., Rios, A.L.G., Trajković, L. (2021). Machine anomaly detection in industrial cyber-physical systems.
learning for detecting anomalies and intrusions in IEEE Transactions on Industrial Informatics, 17(8):
communication networks. IEEE Journal on Selected 5790-5798. https://doi.org/10.1109/TII.2020.3047675
Areas in Communications, 39(7): 2254-2264. [20] de Araujo-Filho, P.F., Kaddoum, G., Campelo, D.R.,
https://doi.org/10.1109/JSAC.2021.3078497 Santos, A.G., Macêdo, D., Zanchettin, C. (2020).
[8] Wang, X., Fidge, C., Nourbakhsh, G., Foo, E., Jadidi, Z., Intrusion detection for cyber–physical systems using
Li, C. (2022). Anomaly detection for insider attacks from generative adversarial networks in fog environment.
untrusted intelligent electronic devices in substation IEEE Internet of Things Journal, 8(8): 6247-6256.
automation systems. IEEE Access, 10: 6629-6649. https://doi.org/10.1109/JIOT.2020.3024800
https://doi.org/10.1109/ACCESS.2022.3142022 [21] Andresini, G., Appice, A., Di Mauro, N., Loglisci, C.,
[9] Hong, W.C., Huang, D.R., Chen, C.L., Lee, J.S. (2020). Malerba, D. (2020). Multi-channel deep feature learning
Towards accurate and efficient classification of power for intrusion detection. IEEE Access, 8: 53346-53359.
system contingencies and cyber-attacks using recurrent https://doi.org/10.1109/ACCESS.2020.2980937
neural networks. IEEE Access, 8: 123297-123309. [22] Larriva-Novo, X.A., Vega-Barbas, M., Villagrá, V.A.,
https://doi.org/10.1109/ACCESS.2020.3007609 Rodrigo, M.S. (2020). Evaluation of cybersecurity data
[10] Qureshi, S., He, J., Tunio, S., Zhu, N., Akhtar, F., Ullah, set characteristics for their applicability to neural
F., Nazir, A., Wajahat, A. (2021). A hybrid DL-based networks algorithms detecting cybersecurity anomalies.
detection mechanism for cyber threats in secure networks. IEEE Access, 8: 9005-9014.
IEEE Access, 9: 73938-73947. https://doi.org/10.1109/ACCESS.2019.2963407
https://doi.org/10.1109/ACCESS.2021.3081069 [23] Pacheco, J., Benitez, V.H., Felix-Herran, L.C., Satam, P.
[11] Habibi, M.R., Sahoo, S., Rivera, S., Dragičević, T., (2020). Artificial neural networks-based intrusion
Blaabjerg, F. (2021). Decentralized coordinated detection system for internet of things fog nodes. IEEE
cyberattack detection and mitigation strategy in DC Access, 8: 73907-73918.
microgrids based on artificial neural networks. IEEE https://doi.org/10.1109/ACCESS.2020.2988055
Journal of Emerging and Selected Topics in Power [24] Li, D., Li, Q., Ye, Y., Xu, S. (2021). A framework for
Electronics, 9(4): 4629-4638. enhancing deep neural networks against adversarial
https://doi.org/10.1109/JESTPE.2021.3050851 malware. IEEE Transactions on Network Science and
[12] Saheed, Y.K., Arowolo, M.O. (2021). Efficient cyber Engineering, 8(1): 736-750.
attack detection on the internet of medical things-smart https://doi.org/10.1109/TNSE.2021.3051354
environment based on deep recurrent neural network and [25] Al-Abassi, A., Jahromi, A.N., Karimipour, H.,
machine learning algorithms. IEEE Access, 9: 161546- Dehghantanha, A., Siano, P., Leung, H. (2021). A self-
161554. tuning cyber-attacks’ location identification approach for
https://doi.org/10.1109/ACCESS.2021.3128837 critical infrastructures. IEEE Transactions on Industrial
[13] Kuang, X., Liu, H., Wang, Y., Zhang, Q., Zhang, Q., Informatics, 18(7): 5018-5027.
Zheng, J. (2019). A CMA-ES-Based adversarial attack https://doi.org/10.1109/TII.2021.3133361
on black-box deep neural networks. IEEE Access, 7: [26] Wang, Z., Song, M., Zheng, S., Zhang, Z., Song, Y.,
172938-172947. Wang, Q. (2019). Invisible adversarial attack against
https://doi.org/10.1109/ACCESS.2019.2956553 deep neural networks: An adaptive penalization approach.
[14] Wang, J., Tan, Y., Liu, J., Zhang, Y. (2020). Topology IEEE Transactions on Dependable and Secure
poisoning attack in SDN-enabled vehicular edge network. Computing, 18(3): 1474-1488.
IEEE Internet of Things Journal, 7(10): 9563-9574. https://doi.org/10.1109/TDSC.2019.2929047
https://doi.org/10.1109/JIOT.2020.2984088 [27] Ma, L., Wang, Z., Liu, H., Alsaadi, F.E., Alsaadi, F.E.
[15] Albahar, M.A., Al-Falluji, R.A., Binsawad, M. (2020). (2022). Neural-network-based filtering for a general
An empirical comparison on malicious activity detection class of nonlinear systems under dynamically bounded

913
 innovations over sensor networks. IEEE Transactions on effective false data injection attack detection in smart
Network Science and Engineering, 9(3): 1395-1408. grid based on Kalman filter and recurrent neural network.
https://doi.org/10.1109/TNSE.2022.3144484 IEEE Internet of Things Journal, 9(9): 6893-6904.
[28] Fotiadou, K., Velivassaki, T.H., Voulkidis, A., Railis, K., https://doi.org/10.1109/JIOT.2021.3113900
Trakadas, P., Zahariadis, T. (2020). Incidents [30] Li, F., Li, Q., Zhang, J., Kou, J., Ye, J., Song, W.,
information sharing platform for distributed attack Mantooth, H.A. (2020). Detection and diagnosis of data
detection. IEEE Open Journal of the Communications integrity attacks in solar farms based on multilayer long
Society, 1: 593-605. short-term memory network. IEEE Transactions on
https://doi.org/10.1109/OJCOMS.2020.2989925 Power Electronics, 36(3): 2495-2498.
[29] Wang, Y., Zhang, Z., Ma, J., Jin, Q. (2021). KFRNN: An https://doi.org/10.1109/TPEL.2020.3017935

914