BCAST IDS: A Novel Network Intrusion Detection System for Broadcast Networks

Network Intrusion Detection Systems (NIDSs) play a pivotal role in cybersecurity by identifying malicious activities through network traffic information to safeguard network infrastructures and digital assets from disruptions and other negative consequences. A modern approach to enhancing the capabilities of NIDSs is the use of machine learning (ML) algorithms that predict attacks based on data. This study introduces a novel and lightweight NIDS called Broadcast IDS (BCAST IDS) that uses specific network traffic patterns and the Isolation Forest algorithm to detect anomalies in broadcast networks. It can also act as a canary token and dynamically learn new network flow patterns based on the network environment. The practical applications are thoroughly explored, and then the solution is deployed within an enterprise network for real-time monitoring and detection using Raspberry Pi devices. The findings show that the tool effectively recognizes certain classes of network scanning attempts that worms and attackers typically perform to find targets, denial-of-service (DoS) attacks, and critical network misconfigurations, reflecting the robustness of its anomaly detection capabilities. Furthermore, the system not only provides significant advantages over other NIDS schemes but also presents strong resistance to various evasion techniques and adversarial attacks.