Hybrid Network Intrusion Detection with Stacked Sparse Contractive Autoencoders and Attention-based Bidirectional LSTM

Abstract

Accurately identifying network intrusion cannot only help individuals and enterprises better deal with network security problems, but also maintain the Internet environment. Currently, classification methods with autoencoders for feature learning have been proved to be suitable for the network intrusion detection. This work proposes a new hybrid classification method named SABD for network intrusion detection. SABD integrates Stacked sparse contractive autoencoders, Attention-based Bidirectional long-term and short-term memory (LSTM), and Decision fusion. SABD integrates the feature extraction of stacked sparse contractive autoencoders with the classification ability of attention-based bidirectional LSTM. Specifically, stacked sparse contractive autoencoders are used for extracting features, which are sent to the attention-based bidirectional LSTM for the classification. Finally, the decision fusion algorithm is adopted to integrate classification results of multiple classifiers and yield the final results. Experimental results based on real-life UNSW-NB15 data demonstrate that the proposed SABD outperforms its state-of-the-art peers in terms of classification accuracy.