TBGD: Deep Learning Methods on Network Intrusion Detection Using CICIDS2017 Dataset

Abstract

With the development of science and technology, more and more personal information is uploaded to the Internet, which poses a serious threat to our personal and property security. As machine learning and deep learning techniques continue to develop, they become increasingly powerful at extracting data and improving the accuracy of classifying malicious traffic. This paper proposes an intrusion detection model based on Transformer, BiGRU, and DNN, referred to as the TBGD model. The Multi-Head Attention mechanism and Feedforward Neural Network in Transformer help capture global relationships and information; BiGRU models sequential information in sequences; DNN learns complex nonlinear relationships and generates accurate intrusion detection predictions. To solve the problem of data set imbalance, we adopted the RUSK sampling mechanism, in which we used Random-Under-Sampler for majority class samples and K-SMOTE oversampling for minority class samples to balance the data set. In addition, the experiment uses the CICIDS2017 dataset. The experiment shows that after the RUSK sampling mechanism balances the data set, the TBGD model has a higher overall classification accuracy and a higher recognition rate for minority classes than the machine learning and deep learning algorithms compared to the experiment.