Intrusion Detection using Deep Learning Long Short-term Memory with Wrapper Feature Selection Method

Sana Al Azwari,Hamza Turabieh

doi:10.14569/ijacsa.2021.0120366

Abstract

Recently, many companies move to use cloud com-puting systems to enhance their performance and productivity. Using these cloud computing systems allows the execution of applications, data, and infrastructures on cloud platforms (i.e., online), which increase the number of attacks on such systems. As a resulting, building robust Intrusion detection systems (IDS) is needed. The main goal of IDS is to detect normal and abnormal network trafﬁc. In this paper, we propose a hybrid approach between an Enhanced Binary Genetic Algorithms (EBGA) as a wrapper feature selection (FS) algorithm and Long Short-Term Memory (LSTM). A novel injection method to prevent premature convergence of the GA is proposed in this paper. An intelligent k-means algorithm is employed to examine the solution distribution in the search space. Once 80% of the solutions belong to one cluster, an injection method (i.e., add new solutions) is used to redistribute the solutions over the search space. EBGA will reduce the search space as a preprocessing step, while LSTM works as a binary classiﬁcation method. UNSW-NB15, a real-world public dataset, is used in this work to evaluate the proposed system. The obtained results show the ability of feature selection method to enhance the overall performance of LSTM.

Highlights

With the exponential growth rates of volumes of data, both structured and unstructured, that are generated from a variety of sources, the need to provide protection and privacy becomes a challenging issue for intrusion detection systems (IDSs) in this big data environment
This section reports the validation of the proposed hybrid method (i.e., Enhanced Binary Genetic Algorithms (EBGA) with Long Short-Term Memory (LSTM)) to detect intrusion in cloud computing systems
It is clear that the performance of feature selection improves the overall performance of LSTM compared to other experiments without feature selection

Summary

Introduction

With the exponential growth rates of volumes of data, both structured and unstructured, that are generated from a variety of sources, the need to provide protection and privacy becomes a challenging issue for intrusion detection systems (IDSs) in this big data environment. Intrusions are suspicious and unauthorized activities on a computer or network that threaten the security of these systems. IDSs are very crucial to ensure network and information security. These systems can be devices or software that monitor systems or networks for malicious activities or violations of security policies. Intrusion detection systems detects unusual attacks based on two methods; signature-based detection and anomaly detection. In signature-based detection, IDS analyzes system activities to find patterns that are similar to previously detected and stored patterns in a database. Intrusion detection using an anomaly detection method which relies on machine learning to build models of patterns of normal behavior on the system or the network (i.e., cloud computing systems) to detect patterns of unusual behavior.

Methods

Results

Conclusion