Knacks of a hybrid anomaly detection model using deep auto-encoder driven gated recurrent unit

Abstract

The cyber-attacks have recently posed a threat to national security; meanwhile, the pervasiveness of malware and cyber terrorism encumbers the beneficial utilization of the internet. Intrusion detection systems (IDS) can prevent such malevolent attacks. Inappropriate and redundant features affect the performance of IDS by slowing down the classification process and leading to incorrect decisions, specifically when dealing with big data. Therefore, in this study, we propose an auto-encoder and gated recurrent unit (GRU) based intrusion detection system (AE-GRU) to accurately, efficiently, and precisely classify network traffic. In the first step, the most relevant features are extracted from the auto-encoder to pass on to the GRU for traffic type classification. Classification of binary and multiclass have been carried out on the well-known NSL-KDD dataset. The AE-GRU is evaluated in terms of performance indices such as accuracy, precision, recall, F-score, MCC, DR, and FAR. The generalization of the proposed technique is also assessed on another dataset UNSW-NB15. Experimental results demonstrate that the AE-GRU outperforms existing methods in terms of all performance indices. Furthermore, the proposed model has also been statistically evaluated using a one-way ANOVA test. Results signify the potential utilization of the proposed technique in network traffic classification.