Deep Learning-based Intrusion Detection System Research Articles

A novel framework for analyzing internet of things datasets for machine learning and deep learning-based intrusion detection systems

To generate a machine learning (ML) and deep learning (DL) architecture with good performance, we need a decent dataset for the training and testing phases of the development process. Starting with the knowledge discovery and data mining (KDD) Cup 99 dataset, numerous datasets have been produced since 1998 to be utilized in the ML and DL-based intrusion detection systems (IDS) training and testing process. Because there are so many datasets accessible, it might be challenging for researchers to choose which dataset to employ. Therefore, a framework for evaluating dataset appropriateness with the research to be conducted is becoming increasingly crucial as new datasets are regularly created. Additionally, given the growing popularity of internet of things (IoT) devices and an increasing number of specific datasets for IoT in recent years, it is essential to have a specific framework for IoT datasets. Therefore, this research aims to develop a new framework for evaluating IoT datasets for ML and DL-based IDS. The study's findings include, first, a novel framework for assessing IoT datasets, second, a comparison of this novel framework to other existing frameworks, and third, an analysis of five IoT datasets by using the new framework.

Multi-stage deep learning-based intrusion detection system for automotive ethernet networks

Modern automobiles are increasing the demand for automotive Ethernet as a high-bandwidth and flexible in-vehicle network technology. However, since Ethernet does not have native support for authentication or encryption, intrusion detection systems (IDSs) are becoming an attractive security mechanism to detect malicious activities that may affect Ethernet-based communication in cars. This paper proposes a novel multi-stage deep learning-based intrusion detection system to detect and classify cyberattacks in automotive Ethernet networks. The first stage uses a Random Forest classifier to detect cyberattacks quickly. The second stage, on the other hand, uses a Pruned Convolutional Neural Network that minimizes false positive rates while classifying different types of cyberattacks. We evaluate our proposed IDS using two publicly available automotive Ethernet intrusion datasets. The experimental results show that our proposed solution detects cyberattacks with a similar detection rate and a faster detection time compared to other state-of-the-art baseline automotive Ethernet IDSs.

Secure deep learning-based energy efficient routing with intrusion detection system for wireless sensor networks

In general, wireless sensor networks are used in various industries, including environmental monitoring, military applications, and queue tracking. To support vital applications, it is crucial to ensure effectiveness and security. To prolong the network lifetime, most current works either introduce energy-preserving and dynamic clustering strategies to maintain the optimal energy level or attempt to address intrusion detection to fix attacks. In addition, some strategies use routing algorithms to secure the network from one or two attacks to meet this requirement, but many fewer solutions can withstand multiple types of attacks. So, this paper proposes a secure deep learning-based energy-efficient routing (SDLEER) mechanism for WSNs that comes with an intrusion detection system for detecting attacks in the network. The proposed system overcomes the existing solutions’ drawbacks by including energy-efficient intrusion detection and prevention mechanisms in a single network. The system transfers the network’s data in an energy-aware manner and detects various kinds of network attacks in WSNs. The proposed system mainly comprises two phases, such as optimal cluster-based energy-aware routing and deep learning-based intrusion detection system. Initially, the cluster of sensor nodes is formed using the density peak k-mean clustering algorithm. After that, the proposed system applies an improved pelican optimization approach to select the cluster heads optimally. The data are transmitted to the base station via the chosen optimal cluster heads. Next, in the attack detection phase, the preprocessing operations, such as missing value imputation and normalization, are done on the gathered dataset. Next, the proposed system applies principal component analysis to reduce the dimensionality of the dataset. Finally, intrusion classification is performed by Smish activation included recurrent neural networks. The proposed system uses the NSL-KDD dataset to train and test it. The proposed one consumes a minimum energy of 49.67 mJ, achieves a better delivery rate of 99.92%, takes less lifetime of 5902 rounds, 0.057 s delay, and achieves a higher throughput of 0.99 Mbps when considering a maximum of 500 nodes in the network. Also, the proposed one achieves 99.76% accuracy for the intrusion detection. Thus, the simulation outcomes prove the superiority of the proposed SDLEER system over the existing schemes for routing and attack detection.

An end-to-end learning approach for enhancing intrusion detection in Industrial-Internet of Things

The Industrial-Internet of Things (I-IoT) stands out as one of the most dynamically evolving subfields within the expansive realm of the Internet of Things (IoT). Its exponential growth is reshaping industrial landscapes, bringing forth transformative innovations and advancements at an unprecedented pace, as the core of Industry 4.0. Among the formidable challenges faced by the Industrial-Internet of Things, cybersecurity stands out as a critical concern. Deep learning-based Intrusion Detection System (IDS) solutions showcase their steadfast ability to secure resource-limited, investigation-demanding, and complex I-IoT environments. However, their effectiveness hinges not only on the model but also on the dataset on which they are trained. While numerous literature studies delve into this field, existing proposed models often grapple with challenges. They are frequently trained on outdated, non-diverse datasets or lack specific features crucial for I-IoT networks. Recent efforts, thankfully, introduce more adequate datasets like Edge-IIoTset. Researchers leverage this extensive dataset to train models, focusing on detecting the 14 sophisticated attacks. These attacks predominantly target real I-IoT networks. Despite these efforts, none of the existing models proves entirely efficient. A review of literature solutions reveals that many models cannot detect all 15 classes in the dataset. Some are multi-staged or overly complex. In response to these challenges, this paper presents an End-to-End learning , non-complex CNN1D model tailored to the specific problem of detecting 14 sophisticated threats targeting I-IoT environments. Our proposed model demonstrated remarkable efficiency with an accuracy of 99.96%, successfully detecting all 15 classes in the Edge-IIoTset dataset with a minimal loss of 0.0011. Not only that, but our model was validated with k-fold cross-validation, demonstrating its efficiency in preserving the same performance on unseen data and its ability to be generalized for real-world I-IoT environments.

An Efficient Deep Learningbased Intrusion Detection System for Internet of Things Networks with Hybrid Feature Reduction and Data Balancing Techniques

With the increasing use of Internet of Things (IoT) technologies, cyber-attacks on IoT devices are also increasing day by day. Detecting attacks on IoT networks before they cause any damage is crucial for ensuring the security of the devices on these networks. In this study, a novel Intrusion Detection System (IDS) was developed for IoT networks. The IoTID20 and BoT-IoT datasets were utilized during the training phase and performance testing of the proposed IDS. A hybrid method combining the Principal Component Analysis (PCA) and the Bat Optimization (BAT) algorithm was proposed for dimensionality reduction on the datasets. The Synthetic Minority Over-SamplingTechnique (SMOTE) was used to address the problem of data imbalance in the classes of the datasets. The Convolutional Neural Networks (CNN) model, a deep learning method, was employed for attack classification. The proposed IDS achieved an accuracy rate of 99.97% for the IoTID20 dataset and 99.98% for the BoT-IoT dataset in attack classification. Furthermore, detailed analyses were conducted to determine the effects of the dimensionality reduction and data balancing models on the classification performance of the proposed IDS.

Optimizing deep learning-based intrusion detection in cloud computing environment with chaotic tunicate swarm algorithm

Intrusion Detection (ID) in cloud environments is vital to maintain the safety and integrity of data and resources. However, the presence of class imbalance, where normal samples significantly outweigh intrusive instances, poses a challenge in constructing a potential ID system. Deep Learning (DL) methods, with their capability to automatically study complex patterns and features, present a promising solution in various ID tasks. Such methods can automatically learn intricate features and patterns from the input dataset, making them suitable for detecting anomalies and finding intrusions in cloud environments. Therefore, this study proposes a Class Imbalance Data Handling with an Optimal Deep Learning-Based Intrusion Detection System (CIDH-ODLIDS) in a cloud computing atmosphere. The CIDH-ODLIDS technique leverages optimal DL-based classification and addresses class imbalance. Primarily, the CIDH-ODLIDS technique preprocesses the input data using a Z-score normalization approach to ensure data quality and consistency. To handle class imbalance, the CIDH-ODLIDS technique employs oversampling techniques, particularly focused on synthetic minority oversampling techniques such as Adaptive Synthetic (ADASYN) sampling. ADASYN generates synthetic instances for the minority class depending on the available data instances, effectively balancing the class distribution and mitigating the impact of class imbalance. For the ID process, the CIDH-ODLIDS technique utilizes a Fuzzy Deep Neural Network (FDNN) model, and its tuning procedure is performed using the Chaotic Tunicate Swarm Algorithm (CTSA). CTSA is employed to choose the learning rate of the FDNN methods optimally. The experimental assessment of the CIDH-ODLIDS method is extensively conducted on three IDS datasets. The comprehensive comparison results confirm the superiority of the CIDH-ODLIDS algorithm over existing techniques.

Effective Intrusion Detection System Using Deep Learning for DDoS Attacks

An increasing demand for information technology and cloud computing has led to various security threats over internet. Amongst all types of threats, Distributed Denial of Service (DDoS) attacks are the most common, posing a challenge to a cyber security. It allows unauthorized users to gain access to services, and preventing authorized users. Traditional intrusion detection, antivirus software, and firewalls are not enough to detect these attacks. This paper proposed an efficient deep learning-based intrusion detection system (IDS) for DDoS attacks detection. Proposed model is a hybrid CNN-LSTM model which is combination of best DL algorithms to take advantage of CNN to extract spatial features and LSTM to extract temporal features. The real-time DDoS-specific benchmark-dataset CICDDoS2019 used for training, testing, and validation. An autoencoder has been used for dimensionality reduction, and SMOTE method is used to balance the minority class of dataset. The experimental results proved that the model outperforms than other state-of-the-art models, with an accuracy score of 99.86%.

An Explainable and Resilient Intrusion Detection System for Industry 5.0

Industry 5.0 is a futuristic transformative model that aims to develop a hyperconnected, automated, and data-driven industrial ecosystem. This digital transformation will boost productivity and efficiency throughout the production process but will be more prone to new sophisticated cyber-attacks. Deep learning-based Intrusion Detection Systems (IDS) have the potential to recognize intrusions with high accuracy. However, these models are complex and are treated as a black box by developers and security analysts due to the inability to interpret the decisions made by these models. Motivated by the challenges, this paper presents an explainable and resilient IDS for Industry 5.0. The proposed IDS is designed by combining bidirectional long short-term memory networks (BiLSTM), a bidirectional-gated recurrent unit (Bi-GRU), fully connected layers and a softmax classifier to enhance the intrusion detection process in Industry 5.0. Then, we employ the SHapley Additive exPlanations (SHAP) mechanism to interpret and understand the features that contributed the most in the decision of the proposed cyber-resilient IDS. The evaluation of the proposed model using the explainability can ensure that the model is working as expected. The experimental results based on the CICIDDoS2019 dataset confirms the superiority of the proposed IDS over some recent approaches.

A simple framework to enhance the adversarial robustness of deep learning-based intrusion detection system

Deep learning based intrusion detection systems (DL-based IDS) have emerged as one of the best choices for providing security solutions against various network intrusion attacks. However, due to the emergence and development of adversarial deep learning technologies, it becomes challenging for the adoption of DL models into IDS. In this paper, we propose a novel IDS architecture that can enhance the robustness of IDS against adversarial attacks by combining conventional machine learning (ML) models and Deep Learning models. The proposed DLL-IDS consists of three components: DL-based IDS, adversarial example (AE) detector, and ML-based IDS. We first develop a novel AE detector based on the local intrinsic dimensionality (LID). Then, we exploit the low attack transferability between DL models and ML models to find a robust ML model that can assist us in determining the maliciousness of AEs. If the input traffic is detected as an AE, the ML-based IDS will predict the maliciousness of input traffic, otherwise the DL-based IDS will work for the prediction. The fusion mechanism can leverage the high prediction accuracy of DL models and low attack transferability between DL models and ML models to improve the robustness of the whole system. In our experiments, we observe a significant improvement in the prediction performance of the IDS when subjected to adversarial attack, achieving high accuracy with low resource consumption.

A Balanced Intrusion Detection System for Wireless Sensor Networks in a Big Data Environment Using CNN-SVM Model

Wireless Sensor Networks (WSNs) were exposed to several distinct safety issues and attacks regarding gathering and sending data. In this scenario, one of the most prevalent WSN assaults that may target any tier of the protocol stack is the Denial of Service (DoS) attack. The current research suggested various strategies to find the attack in the network. However, it has classification challenges. An effective ensemble deep learning-based intrusion detection system to identify the assault in the WSN network was, therefore, suggested in this research to address this issue. The data pre-processing involves converting qualitative data into numeric data using the One-Hot Encoding technique. Following that, Normalization Process was carried out. Then Manta-Ray Foraging Optimization is suggested to choose the best subset of features. Then Synthetic Minority Oversampling Technique (SMOTE) oversampling creates a new minority sample to balance the processed dataset. Finally, CNN–SVM classifier is proposed to classify the attack kinds. The Accuracy, F-Measure, Precision, and Recall metrics were used to assess the outcomes of 99.75%, 99.21%, 100%, and 99.6%, respectively. Compared to existing approaches, the proposed method has shown to be extremely effective in detecting DoS attacks in WSNs.

Metaverse-IDS: Deep learning-based intrusion detection system for Metaverse-IoT networks

Combining the metaverse and the Internet of Things (IoT) will lead to the development of diverse, virtual, and more advanced networks in the future. The integration of IoT networks with the metaverse will enable more meaningful connections between the 'real' and 'virtual' worlds, allowing for real-time data analysis, access, and processing. However, these metaverse-IoT networks will face numerous security and privacy threats. Intrusion Detection Systems (IDS) offer an effective means of early detection for such attacks. Nevertheless, the metaverse generates substantial volumes of data due to its interactive nature and the multitude of user interactions within virtual environments, posing a computational challenge for building an intrusion detection system. To address this challenge, this paper introduces an innovative intrusion detection system model based on deep learning. This model aims to detect most attacks targeting metaverse-IoT communications and combines two techniques: KPCA (Kernel Principal Component Analysis which was used for attack feature extraction and CNN (Convolutional Neural Networks for attack recognition and classification. The efficiency of this proposed IDS model is assessed using two widely recognized benchmark datasets, BoT-IoT and ToN-IoT, which contain various IoT attacks potentially targeting IoT communications. Experimental results confirmed the effectiveness of the proposed IDS model in identifying 12 classes of attacks relevant to metaverse-IoT, achieving a remarkable accuracy of 99.8% and a False Negative Rate FNR less than 0.2. Furthermore, when compared with other models in the literature, our IDS model demonstrates superior performance in attack detection accuracy.

Deep Reinforcement Learning for intrusion detection in Internet of Things: Best practices, lessons learnt, and open challenges

The Internet of Things (IoT) scenario places important challenges even for deep learning-based intrusion detection systems. IoTs are highly heterogeneous networks in which multiple types of nodes and connections between them proliferate at a fast pace. From a deep learning perspective, such complexity translates into dynamic feature spaces where the extraction of semantic patterns and correlations among features may require sophisticated inductive biases to be learnt by gradient-based techniques. The research community has recently suggested using Deep Reinforcement Learning (DRL) as a potent approach to effectively identify cyber-threat attempts in IoTs.DRL consists of a Markov Decision Process-based meta-model that permits solving high-dimensional combinatorial optimization problems where differentiable supervisory signals may be absent. For this reason, multiple intelligent intrusion detection systems have been proposed for the IoT environment where high-level requirements are been pursued alongside the detection accuracy. These goals are related to optimizing the computational overhead, reducing power consumption at the edge, and preserving the privacy of sensitive information, among others.This survey offers a clear bird’s eye view of the most recent design choices for DRL-based intrusion detection systems with a focus on the specific context of IoT. Our aim is not only to offer an exhaustive taxonomy of design alternatives made by DRL practitioners in the field of Intrusion detection, but also to discuss the advantages and the effective deployment of each setting concerning real IoT environments. We hope this work would guide the researchers interested in Intrusion Detection for IoTs to establish solid criteria for the most effective usage of Deep Reinforcement Learning in their future work.

An adaptable deep learning-based intrusion detection system to zero-day attacks

The main challenge of an intrusion detection system (IDS) is detecting novelties (i.e., zero-day attacks) in addition to generating a report about the known attacks (i.e., classifying known attacks). Another challenge of an IDS is the adaptation to the detected novelties. For this purpose, it needs sufficient labeled samples of the new attacks. On the other hand, the labeling procedure is a time-consuming task for the security expert teams.This paper proposes a DL-based IDS framework adaptable to new attacks, consisting of different phases. The first phase uses deep learning-based open set recognition methods to identify unknown samples (i.e., new attacks), and make a report from different known attacks simultaneously. Then, the novel samples are clustered by combining the deep model and clustering algorithms. These clusters are the main key to making the labeling procedure more practical and reducing the time and effort of the expert knowledge team. Finally, we use the labeled groups to update the model and make it adaptable to new traffic behaviors.To evaluate the proposed framework, we compare our proposed DOC++ alongside different algorithms (including DOC, OpenMax, AutoSVM, and CROSR) in the open set recognition phase of the framework and use both the CIC-IDS2017 and CSE-CIC-IDS2018 data sets for the evaluation. Our results show that DOC++ achieves the best performance among the other open set recognition approaches. Besides, the completeness and homogeneity of the clustering phase prove that the generated labeled groups are good enough for the supervised labeling and updating phases.

Differential evolution-based convolutional neural networks: An automatic architecture design method for intrusion detection in industrial control systems

Industrial control systems (ICSs) are facing serious and evolving security threats because of a variety of malicious attacks. Deep learning-based intrusion detection systems (IDSs) have been widely considered as one of promising security solutions for ICSs, but these deep neural networks for IDSs in ICSs have been designed manually, which are extremely dependent on expert experience with numerous model parameters. This paper makes the first attempt to develop an automatic architecture design method of convolutional neural networks (CNNs) based on differential evolution (abbreviated as DE-CNN) for the intrusion detection issue in ICSs. The first phase of the proposed DE-CNN is the off-line architecture optimization of the CNNs constructed by three basic units such as ResNetBlockUnit, DenseNetBlockUnit, and PoolingUnit, including encoding the architecture parameters of a CNN as a population, evaluating the fitness of the population by the validation accuracy and the number of CNN model parameters, implementing the evolutionary process including mutation and crossover operations, and selecting the best individual from the population. Then, the optimal CNN model obtained by the off-line optimization of DE-CNN is deployed for the online IDSs. The experimental results on two intrusion detection datasets in ICSs including SWaT and WADI have demonstrated the superiority of the proposed DE-CNN to the state-of-the-art manually-designed and neuroevolution-based methods under both unsupervised and supervised learning in terms of Precision, Recall, F1-Score and the number of the CNN model parameters.

An Effective Deep Learning Based Multi-Class Classification of DoS and DDoS Attack Detection

In the past few years, cybersecurity is becoming very important due to the rise in internet users. The internet attacks such as Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks severely harm a website or server and make them unavailable to other users. Network Monitoring and control systems have found it challenging to identify the many classes of DoS and DDoS attacks since each operates uniquely. Hence a powerful technique is required for attack detection. Traditional machine learning techniques are inefficient in handling extensive network data and cannot extract high-level features for attack detection. Therefore, an effective deep learning-based intrusion detection system is developed in this paper for DoS and DDoS attack classification. This model includes various phases and starts with the Deep Convolutional Generative Adversarial Networks (DCGAN) based technique to address the class imbalance issue in the dataset. Then a deep learning algorithm based on ResNet-50 extracts the critical features for each class in the dataset. After that, an optimized AlexNet-based classifier is implemented for detecting the attacks separately, and the essential parameters of the classifier are optimized using the Atom search optimization algorithm. The proposed approach was evaluated on benchmark datasets, CCIDS2019 and UNSW-NB15, using key classification metrics and achieved 99.37% accuracy for the UNSW-NB15 dataset and 99.33% for the CICIDS2019 dataset. The investigational results demonstrate that the suggested approach performs superior to other competitive techniques in identifying DoS and DDoS attacks.

Blockchain-Assisted Hybrid Harris Hawks Optimization Based Deep DDoS Attack Detection in the IoT Environment

The Internet of Things (IoT) is developing as a novel phenomenon that is applied in the growth of several crucial applications. However, these applications continue to function on a centralized storage structure, which leads to several major problems, such as security, privacy, and a single point of failure. In recent years, blockchain (BC) technology has become a pillar for the progression of IoT-based applications. The BC technique is utilized to resolve the security, privacy, and single point of failure (third-part dependency) issues encountered in IoT applications. Conversely, the distributed denial of service (DDoS) attacks on mining pools revealed the existence of vital fault lines amongst the BC-assisted IoT networks. Therefore, the current study designs a hybrid Harris Hawks with sine cosine and a deep learning-based intrusion detection system (H3SC-DLIDS) for a BC-supported IoT environment. The aim of the presented H3SC-DLIDS approach is to recognize the presence of DDoS attacks in the BC-assisted IoT environment. To enable secure communication in the IoT networks, BC technology is used. The proposed H3SC-DLIDS technique designs a H3SC technique by integrating the concepts of Harris Hawks optimization (HHO) and sine cosine algorithm (SCA) for feature selection. For the intrusion detection process, a long short-term memory auto-encoder (LSTM-AE) model is utilized in this study. Finally, the arithmetic optimization algorithm (AOA) is implemented for hyperparameter tuning of the LSTM-AE technique. The proposed H3SC-DLIDS method was experimentally validated using the BoT-IoT database, and the results indicate the superior performance of the proposed H3SC-DLIDS technique over other existing methods, with a maximum accuracy of 99.05%.

Deep Learning-Based Intrusion Detection System for Internet of Vehicles

The growth of the Internet of Things (IoT) has resulted in several revolutionary applications, such as smart cities, cyber-physical systems, and the Internet of vehicles (IoV). Within the IoV infrastructure, vehicles are comprised of various electronic intelligent sensors or devices used to obtain data and communicate the necessary information with their surroundings. One of the major concerns about the implementation of these sensors or devices is data vulnerability; thus, it is necessary to present a solution that provides security, trust, and privacy to communicating entities and to secure vehicle data from malicious entities. In modern vehicles, the controller area network (CAN) is a fundamental scheme for controlling the interaction among different in-vehicle network sensors. However, not enough security features are present that support data encryption, authorization, and authentication mechanisms to secure the network from cyber or malicious intrusions such as denial of service and fuzzy attacks. An intrusion detection system is presented in this work based on the deep learning architecture to protect the CAN bus in vehicles. The VGG architecture is used and trained for different network intrusion patterns in order to detect malicious attacks. The experiments are performed using the CAN-intrusion-dataset. The experimental findings demonstrate that the presented deep learning system significantly reduces the false positive rate (FPR) compared to the conventional machine learning techniques. The overall accuracy of the system is 96% with FPR of 0.6%.

A hybrid deep learning-based intrusion detection system for IoT networks.

The Internet of Things (IoT) is a rapidly evolving technology with a wide range of potential applications, but the security of IoT networks remains a major concern. The existing system needs improvement in detecting intrusions in IoT networks. Several researchers have focused on intrusion detection systems (IDS) that address only one layer of the three-layered IoT architecture, which limits their effectiveness in detecting attacks across the entire network. To address these limitations, this paper proposes an intelligent IDS for IoT networks based on deep learning algorithms. The proposed model consists of a recurrent neural network and gated recurrent units (RNN-GRU), which can classify attacks across the physical, network, and application layers. The proposed model is trained and tested using the ToN-IoT dataset, specifically collected for a three-layered IoT system, and includes new types of attacks compared to other publicly available datasets. The performance analysis of the proposed model was carried out by a number of evaluation metrics such as accuracy, precision, recall, and F1-measure. Two optimization techniques, Adam and Adamax, were applied in the evaluation process of the model, and the Adam performance was found to be optimal. Moreover, the proposed model was compared with various advanced deep learning (DL) and traditional machine learning (ML) techniques. The results show that the proposed system achieves an accuracy of 99% for network flow datasets and 98% for application layer datasets, demonstrating its superiority over previous IDS models.

Anomaly-Based Intrusion Detection System using One-Dimensional Convolutional Neural Network

As technologies in information and virtualization evolve, the volume of security threats attempting to cause damage to systems grows and becomes more powerful, which highlights the importance of Intrusion Detection Systems (IDS) to have an essential role in network security and help in detecting malicious attacks from network traffic. The most widely used network anomaly detection systems are based on Machine Learning (ML) techniques such as Decision Tree (DT), Support Vector Machine (SVM), and K-nearest Neighbors (KNN). Although IDSs based on ML techniques have achieved promising results and high detection rates, however, it is considered a type of shallow learning that depends mainly on feature engineering and requires large-scale data pre-processing as the size of the dataset grows. To overcome these problems, Deep learning-based IDSs are proposed because they have a better ability to extract features from huge amounts of data. In this research, an IDS model based on one-dimensional Convolution Neutron Network (CNN1D) is proposed that is able to detect anomalies with accuracy of 93.2% and F1-score of 93.1%. Entire NSL-KDD benchmark dataset was used to train this model. Achieved results are then compared to Deep Learning (DL) methods like CNN, LSTM, Recurrent Neural Network (RNN), and others to prove the proposed model's superiority over existing models in literature.

A deep learning-based intrusion detection system for in-vehicle networks

Modern vehicles are increasingly getting connected within the vehicles, with other systems, leading to more concerns about security. Controller area network (CAN) has become a de-facto standard for connecting internal vehicles’ components. However, it lacks security features. Conventional security mechanisms fail to protect in-vehicle networks from attacks, requiring the development of an effective intrusion detection system (IDS). This work develops an IDS for in-vehicle networks called IDS-IVN based on a compact representation of location invariant and time-variant traffic features using deep learning. The IDS-IVN uses convolutional neural and long–short-term memory networks as encoder/decoder functions of autoencoder networks to extract features from raw data and classify them using latent space representation into intrusive and non-intrusive classes. A benchmark real-time ROAD dataset is used to demonstrate the IDS-IVN’s performance compared to the existing methods. IDS-IVN reports 99% accuracy with a 0.32% low false-positive rate for detecting intrusions.