SAAE-DNN: Deep Learning Method on Intrusion Detection

Chaofei Tang,Nurbol Luktarhan,Yuxin Zhao

doi:10.3390/sym12101695

Abstract

Intrusion detection system (IDS) plays a significant role in preventing network attacks and plays a vital role in the field of national security. At present, the existing intrusion detection methods are generally based on traditional machine learning models, such as random forest and decision tree, but they rely heavily on artificial feature extraction and have relatively low accuracy. To solve the problems of feature extraction and low detection accuracy in intrusion detection, an intrusion detection model SAAE-DNN, based on stacked autoencoder (SAE), attention mechanism and deep neural network (DNN), is proposed. The SAE represents data with a latent layer, and the attention mechanism enables the network to obtain the key features of intrusion detection. The trained SAAE encoder can not only automatically extract features, but also initialize the weights of DNN potential layers to improve the detection accuracy of DNN. We evaluate the performance of SAAE-DNN in binary-classification and multi-classification on an NSL-KDD dataset. The SAAE-DNN model can detect normally and attack symmetrically, with an accuracy of 87.74% and 82.14% (binary-classification and multi-classification), which is higher than that of machine learning methods such as random forest and decision tree. The experimental results show that the model has a better performance than other comparison methods.

Highlights

With the development and perfection of Internet technology, the Internet is playing an increasingly significant role in our work and life
Stacked Attention AutoEncoder (SAAE)-deep neural network (DNN) improves the accuracy of intrusion detection system (IDS) and provides a new research method for intrusion detection; We introduce attention mechanism to highlight the key inputs in the stacked autoencoder (SAE) model
True Positive (TP) is the number of records where attack traffic is correctly classified as attack traffic; True Negative (TN) is the number of records in which normal traffic is correctly classified as normal traffic; false positive (FP) is the number of records that mistakenly classify normal traffic as attack traffic; False Negative (FN) is the number of records that mistakenly classify attack traffic as normal traffic

Summary

Introduction

With the development and perfection of Internet technology, the Internet is playing an increasingly significant role in our work and life. In the process of using and interacting with the Internet, a large amount of data are generated, processed, and exchanged. These data have become the targets of illegal activities, which has posed a major threat to network security [1]. As an active security technology, IDS monitors networks or hosts and alerts when attacks are detected. Network security can be better ensured via intrusion detection methods in which the network attack behavior can be learned through data analysis and modeling. The AE structure includes an input layer, a latent layer, and an output layer. The encoding process from input layer to latent layer is e = f θ ( x ) = s(Wx + b)

Methods

Results

Conclusion