Representation learning-based network intrusion detection system by capturing explicit and implicit feature interactions

Abstract

Network intrusion detection system is an important cyber defence tool to protect a system from illegal attacks. Building an effective network intrusion detection system that makes good use of deep learning methods is a challenging task. From the object perspective, different types of malicious attacks have a quite imbalance distribution, especially compared with normal network behaviour. From the feature perspective, the network behaviour description contains heterogeneous features, including numeric and categorical features and complex interactions among these features. To address these two challenges, we propose a novel Network Intrusion Detection System which by learning explicit and implicit feature interactions based on representation learning, i.e., RL-NIDS, which models the network behaviour by learning explicit and implicit feature interactions in both feature value representation and object representation spaces. Specifically, the RL-NIDS consists of two main modules, i.e., unsupervised Feature Value Representation Learning module (FVRL) which aims to learn the feature interactions among categorical features explicitly, and supervised Neural Network for object Representation Learning (NNRL) which aims to learn the implicit interactions in the representation space. Experiments show the effectiveness of RL-NIDS and the object representation learned by RL-NIDS with multiclass classification on two real-world datasets. The RL-NIDS outperforms the state-of-the-art feature selection-based methods and deep learning-based methods in terms of both overall accuracy, precision, recall, and F1 score. The accuracy of classification of NSL-KDD and AWIDS dataset is 81.38% and 95.72%, respectively, achieve 3.9% and 0.9% improvements compare to the second-best method. Moreover, a thorough ablation study demonstrates the contributions of both FVRL and NNRL which complement each other for capturing feature interactions.