High‐performance anomaly intrusion detection system with ensemble neural networks on reconfigurable hardware

Abstract

SummaryIn this article, we propose an ensemble neural network approach so that multiple neuron network models can be deployed concurrently for detecting anomalies in a system. Additionally, a high‐performance architecture integrating the neural networks for reconfigurable hardware is also designed to exploit the parallelism of the technology. We carefully implement four different models for detecting SYN, DNS, UNP, and ICMP attacks with the same configuration of neural networks on the NetFPGA platform. The neural networks can be executed in the pipeline to improve performance. Experiments with the generated dataset are conducted to test both performance in terms of throughput and accuracy. Our experimental results show that the system can process packets with throughput up to 30.48Gbps and is able to recognize 99.98% attacking packets with only 0.98% false alarms.