Fast Localization Model of Network Intrusion Detection System for Enterprises Using Cloud Computing Environment

With the advancement of network security, intrusion detection system (IDS) is increasingly used for network-connected environments. As the work of enterprises, governments, and other organizations has increasingly relied on computer network systems, protecting these systems from attacks has become a top priority. IDS has become an essential tool for safeguarding the systems with the increasing number of connected devices. To address the shortcomings of existing IDS, this research proposes an Enterprise Network for Intrusion Detection System (ENIDS) with a fast localization algorithm for cloud-based infrastructure. The proposed system detects and locates attacks by identifying abnormal domain values in the header of packets at the data link layer, network layer, and transport layer. ENIDS comprises three components: an event generator that serves as the source of event record flow, an analysis engine that checks if an attack has occurred based on the information sent by the event generator, and a reaction component that generates a response based on the results of the analysis engine. Additionally, this paper explains the fast localization model of intrusion detection for data of enterprises by explaining keyword selection methods. Experimental results show that the proposed method has a higher localization rate in comparison to direct localization, with a localization rate of 95.7% for the static targets and 92.7% for the dynamic targets. ENIDS has also been compared to existing systems using Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF). The proposed method has the highest accuracy (96.25%), precision (95.57%), recall (92.24%), and F1-score (93.57%). The simulation results show that the model is effective and can detect and locate the data intrusion behavior quickly.