Cloud-based Real-time Network Intrusion Detection Using Deep Learning

Abstract

Deep learning has increased in popularity with researchers and developers investigating and using it for various use cases and applications. This research work focuses on realtime network intrusion detection by making use of deep learning. A cloud-based prototype system was developed to investigate the capability of deep learning based binomial classification and multinomial models to detect network intrusions in real-time. An evaluation study was carried out using the benchmark NSL-KDD dataset to compare deep learning models built using H2O and DeepLearning4J libraries, with other commonly used machine learning models such as Support Vector Machines, Random Forest, Logistic Regression and Naive Bayes. The results showed that the choice of the deep learning library is an important factor to consider for real-time applications. The H2O deep learning based binomial and multinomial models generally outperformed the other models, achieving over 99.5% accuracy using cross-validation on the NSL-KDD training dataset and over 83% accuracy on the test dataset.