Keywords

1 Introduction

The wireless sensor networks have many applications in the field of detection of the air quality, volcanoes, earthquake, flood, health care, and in telecommunication. The wireless sensor network has physical insecurities, limited processing power, less availability of memory, and no well-defined boundaries; i.e., the boundaries are changed on the movement of either device or users; due to these, the wireless sensor network is prone to threat. The distributed denial of service attack and denial of service attacks are easily deployable attack in the wireless sensor network [1]. The intrusion detection and prevention mechanism is more important because in wireless sensor network the implementation of advanced encryption algorithm, large authentication protocols, and other cryptographic algorithm are not feasible [2]. The intrusion detection is done easily using the concept of deep learning as well as machine learning techniques. The wireless network mainly threatens in areas such as attack on sensors, attack on the network service, and attacks on the application services.

The attacks which mainly occur on sensors are location tracking, device cloning, and physical attacks. Similarly, attacks on network service are routing attacks and on application services are distributed denial of service, denial of service attack, and eavesdropping etc. The intrusion detection main aim is to avoid compromises to confidentiality, and availability [3]. Due to the advancement in the field of IOT devices, automation system results in the smart parking system, automated homes, smart cities, smart traffic light system, smart electric meters, and sensors nodes, etc. These are interconnected with communication protocols, and gateway is used to connect with Internet due to which the securities attack increased [4]. The devices which are used in wireless sensor network mainly have less memory and also depend upon the batteries.

These devices have almost negligible security because of lack of deployment of encryption algorithm, antivirus, and other cryptographic techniques. The propositioned tactic is centered on the anomaly intrusion detection, and their prevention with the recurrent neural networks as classifier and validation of the model takes place using tenfold cross-validation mechanism on the wireless sensor network data set (WSN-DS). The feature which is generally used for classification is the abnormal traffic on network, data transfer rate, etc. The proposed model easily detects the attacks in the network. The recurrent neural network is trained for detecting the attack such as user to root attack, remote to local, denial of service, and distributed denial of service attack. Some artificial neural network-based mechanism is proposed such as backpropagation which is not lightweight and attack type is flooding attack whose accuracy is closer to 90%, and the feedforward algorithm which is lightweight in nature and attack type which is malicious node, and accuracy which is almost 95%.The remaining paper is described as follows. Section 2 describes the related work, Sect. 3 describes the proposed methodology, Sect. 4 involves the result section of the paper, and Sect. 5 has the conclusion of the paper.

2 Related Work

One of previously proposed models for detection of denial of service attack and the KDD Cup99 data set is used, and this model is capable of detecting the flooding attack and denial of service attack with higher precision and accuracy [5]. Papers [6] and [7] have proposed a model in which the artificial neural network is used for detection of the intrusions. The KDD Cup99 data set is used, and the feature selection takes place using backpropagation algorithm. This model is suitable for the real-time applications also, and with this, gray-hole attack as well as denial of service attack is easily detected with higher accuracy. Papers [8] and [9] have proposed a model for intrusion detection using artificial neural network, and in this, the classification can be done using backpropagation algorithm, and the KDD Cup99 data set is used for training and testing purposes. Papers [5] and [10] have defined a model in which layered categories are used for the classification purpose to detect intrusions and the artificial neural network as well as the support vector machine and KDD Cup99 data set is used in the implementation of model. Papers [11] and [12] have proposed a model in which the machine learning classifier such as random forest and artificial neural network are used for the classification, detection and prevention of network-based intrusion respectively. Papers [8] and [13] have given a model in which the machine learning classifier such as decision tree is for the classification and artificial neural network is for detection and prevention of network-based intrusion. Paper [14] has proposed a technique for intrusion detection and classification of the attacks with help of the artificial neural network. In this, the multi-layer perceptron architecture is used. The KDD Cup99 data set is used for training and testing the model, and it detects various attacks and after that classifies in into six different clusters. Paper [15] proposed model for detection of network intrusion with the help of the multi-layer perceptron architecture and the artificial neural network. In this, some relevant features of attacks are used instead of all features of the packet. The model accuracy is better in case of detection of denial of service attack. Papers [16] and [17] proposed a model which is based on feature-reduced intrusion detection, and it analyzed important features of data dimensionality reduction take place then the reduced features are feed to feedforward neural network for training and testing using the KDD Cup99 data set, and this model uses artificial neural network classify normal and abnormal data. In papers [15] and [18], the given model for detection of intrusion in wireless sensor network is based on the mechanism of the genetic programming. The genetic programming involves gene-expression mechanism, linear genetic programming mechanism, and multi-programming mechanism for the detection of the intrusions, and the accuracy of the model is more than 95%. In papers [2] and [19], another model is proposed which is totally based on the fuzzy logic for intrusion detection in wireless sensor network. In this, the author claims that using this model, all types of the intrusions are detected easily with accuracy of 100%. Papers [14] and [20] have given a mechanism which is based on the concept of rule-based decentralized mechanism which detects the different type attacks of the wireless sensor network such as black hole attack, worm hole attack, and selective hole attack. The accuracy of the model is better, and the positive fault rate is minimal. Papers [6] and [21] have proposed a model which is based on the concept of the clustering mechanism. In this, the detection of intrusions takes place on the basis of differentiating between the abnormal traffic on the network and normal traffic on the network. Have proposed one of the models in which support vector machine is used as a classifier and for training and testing the model using distributed learning algorithm is used. Papers [5] and [22] have proposed one of the models in which decision tree is used as a classifier, and for training and testing, distributed learning algorithm is used. Papers [3] and [11] have proposed one of the models in which convolution neural network is used as a classifier, and for training and testing, distributed learning algorithm is used. Papers [4] and [10] have proposed one of the models in which random forest is used as a classifier, and for training and testing, the distributed learning algorithm is used. The detection of malicious file in this model is more accurate and also applicable in real-life scenario. One of models is proposed in which deep learning algorithm is used. In this, the fog node used is of high bandwidth and power of computation enhanced the deployment of the deep learning services. The farmer’s get more information about their crop, and also the quality of life of farmers is improved. The result of the proposed work shows that accuracy of the model is good [23]. One model is proposed for addressing the data mining chaos such as scalability, security and privacy, and efficiency. The complexity of the model is linear in nature due to which the model is more efficient. The model provides more resistant to the system from attacks, and also, the accuracy of model is better [24]. A technique to decide highest quality time and highest quality fee to withdraw a voluntary retirement scheme thinking about chance of recognition of a retirement request of a retirement request fee because of saying voluntary retirement scheme and to the enterprise because of one-time unique bills to folks that voluntarily retire for the duration of the term is discussed. A specific case wherein a Poisson n a Poisson manner is believe for the statement of the voluntary retirement scheme [25]. One of the models is proposed which helps in the identification of the name of the resources which are allocated in the cloud. The mechanism used is round robin and first come first serve for minimizing the cost of demand and time [26].

3 Method and Material

In the intrusion detection and prevention system proposed involves the following stages such as feature extraction, classifier, training and testing, data set, and decision. At the stage of feature extraction, some features are extricated from the provided data and used as a feature and also some features are mixed with other features and considered as single feature for classification with the help of which the classification result accuracy is improved. The next stage is of classifier, and recurrent neural network is used as a classifier. In the papers [19] and [8], training and testing are done using the WSN-DS. The resilient backpropagation learning strategy is applied for training neural network in which rate of learning is 0.01, and to train, 1000 epochs are used. According to received data at classifier stage, the classification take place and then result is forwarded at the decision stage and decision stage decisions are made either data packet is accepted or rejected and automatically notify at the base station. The given model in the paper [13] intrusion detection and prevention system uses the only header of the data, but in this, both header and the payload of the data are considered for making decision due to which the accuracy of the model is enhanced [13]. The anomaly-based intrusion detection system is mainly compromises of only two phases that is training phase and testing phase. In this, the deviation between the perceived behavior and the model is regarded as an abnormality and the feature selection is considered during the training phase of the recurrent neural network [27]. The ability of learning from data set depends upon neural network used, and categorizing the file or packet coming through network as abnormal or normal will be done by some computing techniques of neural network. The network traffic data is collected using image, library files, log file, dynamic link, and other files such as log file, music file, and word file documents (Fig. 1).

Fig. 1
figure 1

Model of IDPS using RNN

Full size image

4 Result and Discussion

In our proposed model, recurrent neural network is trained using the WSN-DS data set with help of the tenfold cross validation method in nine is to one iteration with two hidden layers and three hidden layers. The classification of the attacks classified correctly up to 98.6% with two hidden layers and error is approximately 0.0343, when three hidden layer are used for the classification of attacks take place correctly up to 98.34 with error of 0.0643. In case of the using two hidden layers, at first layer, the number of neurons used is 11, and in the second layer, the number of neurons is five, and in case of three hidden layers, the number of neurons at first layer is 11, and at second hidden layer, five neurons are used, and at last hidden layer, the number neurons used is two. The number of passes or epochs used through training data is 1000. The proportion of validation set from the data used for training is 20%, the learning rate in proposed model is used for the adjustment of the weight at each iteration, and the learning rate of this model is approximately 0.3, and the momentum of model is used for adjustment of weight during the backpropagation in order to prevent local minima and speed up convergence, and momentum of this model is 0.2. The tenfold cross-validation method is used in (9:1) repeated manner with the help of which the accuracy of classification is enhanced. Some of the term is used for showing the result of the model which is the true negative means of the number of normal attacks that are classified as normal (no attack), as well as false negative, which refers to the number of attack cases that are wrongly classified as normal (no attack), and the false positive which means the normal (no attack) cases classified incorrectly as attack. The rate of true positive and false positive is calculated with the help of formulae (Figs. 2, 3 and 4; Tables 1 and 2).

$$ \begin{aligned} & ({\text{TPR}} = \left( {{\text{TP}}/\left( {{\text{TP}} + {\text{FN}}} \right)} \right) \\ & ({\text{TNR}} = \left( {{\text{TN}}/\left( {{\text{FN}} + {\text{TP}}} \right)} \right) \\ & ({\text{FPR}} = \left( {{\text{FP}}/\left( {{\text{FP}} + {\text{TN}}} \right)} \right) \\ \end{aligned} $$
Fig. 2
figure 2

Training of model using multiple classifiers

Full size image
Fig. 3
figure 3

Testing ROC curve using multiple classifiers

Full size image
Fig. 4
figure 4

ROC curve of RNN

Full size image
Table 1 Result using two hidden layer
Full size table
Table 2 Result using three hidden layer
Full size table

The receiver operating characteristic curve is used to describe the total distinction of the classification model. If the area under the curve is high, then it means that the classifier used is better. In the above ROC curve, bold blue indicates the norm of receiver operating characteristics curve of all 500 iterations of the repeated tenfold cross-validation, and the gray-shaded area directs the extent of the receiver operating characteristic curve produced over all iterations. The dashed red line in the curve indicates the ability of the classifier that is the accuracy of the classification of files either it is malicious or no malicious to which class it belongs to at random a baseline for the worst case class. In another way the red dashed line is the base line for worst case classification performance.

5 Conclusion

The main aim of intrusion detection system is to avert compromise to CIA triads of security model of the system. In the proposed method, RNN is used as classifier using which the classification of malicious and non-malicious file is detected. The data set used is WSN-DS which is created using the leach protocol. A WSN-DS data set consists of 17 attributes and 374,000 rows. The accuracy of the model is better with two hidden layer in detection of distributed denial of service attack and denial of service attack with positive fault rate of 0.3. The validation of model is done using of tenfold in nine is to one repeated iteration mechanism due to which the fault rate is minimal and the accuracy is better. The flooding attack, gray-hole attack, and other attacks are also detected with better accuracy.