LSTM-based Network Attack Detection: Performance Comparison by Hyper-parameter Values Tuning

Abstract

Network attacks have been around since the beginning of the Internet and they are still relevant due to the numerous attempts of independent hackers, cybercrime organizations and state-sponsored hacking squads to intrude into others computer networks. Similarly, the industry and academia have been providing constantly evolving solutions to try to thwart the ever-sophisticated network attack techniques. Machine learning (ML) and deep learning have shown promising results for detecting and preventing network attacks. In this paper, we investigate a Long Short-Term Memory (LSTM)-based network attack detection. Our goal is to find the optimal values for network attack detection by fine-tuning different LSTM hyper-parameters: optimizers, loss functions, learning rates and activation functions, and by comparing their performance by using the CICIDS2017 labeled dataset. Our results show that LSTM can effectively detect the network attacks with high accuracy and reasonable detection rates. With the optimized hyper-parameter values, the proposed LSTM model can detect DoS attacks with an effective detection accuracy of 99.08% and a detection rate of 0.93. We achieved BoT, DDoS, and port scan attacks detection accuracy of 99.54% and detection rate of 0.84.