A Self-adaptive Intrusion Detection Model Based on Bi-LSTM-CRF with Historical Access Logs

Abstract

AbstractIntrusion detection mechanism is an important way to protect user data privacy. In the traditional network intrusion detection model, once security policies and rules are determined, they will not be modified during the operation of the system. Such systems lack the ability to dynamically perceive system risk, so that attackers have the opportunity to try and discover vulnerabilities in the system, so that system exposes this risk. This article introduces the intrusion detection rule of the bi-directional long short-term memory (LSTM) conditional random field (CRF) model into the system, and proposes an intrusion detection model with self-learning capabilities. After preprocessing and tagging the history log, the model can extract the valid feature vector of the user accesses the URL to perceive the user’s abnormal access. Second, we use the K-fold method to divide the data into training sets and test sets. We have achieved the best learning strategy by experimenting with different learning rates, comparing F1 values and learning rates. Compared with LSTM, BI-LSTM, CRF model, the model performed well with an F1-score of 87.80%. It demonstrates the accuracy and reliability of the model. Finally, through theoretical analysis and experiment, we prove that our algorithm is self-adaptive. KeywordsDeep learningIntrusion detectionShort-term memory modelConditional random field model