Intrusion Detection Performance Research Articles

Enhancing network intrusion detection performance using generative adversarial networks

Network intrusion detection systems (NIDS) play a pivotal role in safeguarding critical digital infrastructures against cyber threats. Machine learning-based detection models applied in NIDS are prevalent today. However, the effectiveness of these machine learning-based models is often limited by the evolving and sophisticated nature of intrusion techniques as well as the lack of diverse and updated training samples. In this research, a novel approach for enhancing the performance of an NIDS through the integration of Generative Adversarial Networks (GANs) is proposed. By harnessing the power of GANs in generating synthetic network traffic data that closely mimics real-world network behavior, we address a key challenge associated with NIDS training datasets, which is the data scarcity. Three distinct GAN models (Vanilla GAN, Wasserstein GAN and Conditional Tabular GAN) are implemented in this work to generate authentic network traffic patterns specifically tailored to represent the anomalous activity. We demonstrate how this synthetic data resampling technique can significantly improve the performance of the NIDS model for detecting such activity. By conducting comprehensive experiments using the CIC-IDS2017 benchmark dataset, augmented with GAN-generated data, we offer empirical evidence that shows the effectiveness of our proposed approach. Our findings show that the integration of GANs into NIDS can lead to enhancements in intrusion detection performance for attacks with limited training data, making it a promising avenue for bolstering the cybersecurity posture of organizations in an increasingly interconnected and vulnerable digital landscape.

ENHANCING NETWORK INTRUSION DETECTION WITH MOUNTAIN GAZELLE OPTIMIZER-BASED FEATURE SELECTION

Network intrusion detection systems (NIDS) play a critical role in safeguarding modern networks. Feature selection techniques are essential for optimizing NIDS performance by reducing dimensionality and enhancing classifier efficiency. This study proposes the Mountain Gazelle Optimizer (MGO), a novel nature-inspired metaheuristic, for effective feature selection within the context of network intrusion detection. MGO's performance is evaluated on the benchmark UNSW-NB15 dataset in conjunction with a diverse suite of classifiers: Support Vector Machines (SVM), K-Nearest Neighbors (KNN), Random Forest Classifiers (RFC), Decision Tree Classifiers (DTC), and Gaussian Naive Bayes (GNB). Our analysis investigates the impact of MGO-based feature selection on key NIDS performance metrics including accuracy, specificity, sensitivity, and computational runtime. Results demonstrate the potential of MGO to identify optimal feature subsets, leading to significant improvements in network intrusion detection performance across these varied algorithmic approaches. Additionally, we explore the comparative advantages of MGO-based feature selection for specific types of network attacks represented within the UNSW-NB15 dataset. Keywords: Intrusion Detection System (IDS), Mountain Gazelle Optimizer, Feature Selection, SVM, KNN, Naive Bayes, Classification, Optimization, Machine Learning.

Machine learning-enabled hybrid intrusion detection system with host data transformation and an advanced two-stage classifier

Network Intrusion Detection Systems (NIDS) have been extensively investigated by monitoring real network traffic and analyzing suspicious activities. However, there are limitations in detecting specific types of attacks with NIDS, such as Advanced Persistent Threats (APT). Additionally, NIDS is restricted in observing complete traffic information due to encrypted traffic or a lack of authority. To address these limitations, a Host-based Intrusion Detection system (HIDS) evaluates resources in the host, including logs, files, and folders, to identify APT attacks that routinely inject malicious files into victimized nodes. In this study, a hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. The host data undergoes a Language Processing (NLP)-based Bidirectional Encoder Representations from Transformers (BERT) model from textual representation to a numerical one in order to process host data in a similar way to the network flow data through machine learning models. The feature flattening technique is applied to flatten two-dimensional host-based features that is provided by BERT into one-dimensional vectors so that host-based and network flow-based features can be processed by advanced Machine Learning (ML) models. In order to enhance HIDS effectiveness, a two-stage collaborative classifier is utilized, which applies two tiers of machine learning algorithms, binary and multi-class classifiers, to detect network intrusions. Once a binary classifier is used to detect benign samples to reduce the complexity of the original problem, the attack data are classified by a multi-class supervised learner to identify attack types. Hence, the overall performance of the two-stage collaborative model outperforms the baseline classifier, XGBoost. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1. The performance of XGBoost, which represents conventional ML, is evaluated. Combining host and network features enhances attack detection performance (macro average F1 score) by 8.1% under the CICIDS 2018 dataset and 3.7% under the NDSec-1 dataset. Meanwhile, the two-stage collaborative classifier improves detection performance for most single classes, especially for DoS-LOIC-UDP and DoS-SlowHTTPTest, with improvements of 30.7% and 84.3%, respectively, when compared with the traditional ML models.

Group-Based Federated Knowledge Distillation Intrusion Detection

Intrusion detection based on federated learning allows the sharing of more high-quality attack samples to improve the intrusion detection performance of local models while preserving the privacy of local data. Most research on federated learning intrusion detection requires local models to be homogeneous. However, in practical scenarios, local models often include both homogeneous and heterogeneous models due to differences in hardware capabilities and business requirements among nodes. Additionally, there is still room for improvement in the accuracy of recognizing novel attacks in existing researches. To address the challenges mentioned above, we propose a Group-based Federated Knowledge Distillation Intrusion Detection approach. First, through a step-by-step grouping method, we achieve the grouping effect of intra-group homogeneity and inter-group heterogeneity, laying the foundation for reducing the aggregation difficulty in intra-group homogenous aggregation and inter-group heterogeneous aggregation. Second, in intra-group homogenous aggregation, a dual-objective optimization model is employed to quantify the learning quality of local models. Weight coefficients are assigned based on the learning quality to perform weighted aggregation. Lastly, in inter-group heterogeneous aggregation, the group leader model’s learning quality is used to classify and aggregate local soft labels, generating global soft labels. Group leader models utilize global soft labels for knowledge distillation to acquire knowledge from heterogeneous models. Experimental results on NSL-KDD and UNSW-NB datasets demonstrate the superiority of our proposed method over other algorithms.

A risk-aware and recommender distributed intrusion detection system for home robots

The increasing adoption of home robots, driven by technological advancements and realistic goals, underscores the critical importance of ensuring their security, safety, and privacy. An Intrusion Detection System (IDS) is vital in safeguarding home robots by identifying and responding to potential security threats. However, home robot controllers’ limited computational and energy resources pose challenges. To enhance a home robot’s performance, especially its IDS, one potential solution is to connect it to a home network with a more robust computing infrastructure. Our proposed IDS comprises two components: one resides on a remote PC equipped with substantial computing power, and the other operates directly within the robot controller. By leveraging the remote PC, we achieve enhanced intrusion detection performance and gain valuable recommendations for fine-tuning the intrusion detection component situated in the controller. Simultaneously, it becomes imperative to swiftly identify security threats and prioritize high-risk attacks within the robot controller In this study, we employed machine learning techniques within the IDS. The dataset was generated by simulating robot actions within a home network. Based on our evaluation results, adopting a deep learning model for detecting intrusions in a remote PC and with its recommendations for fine-tuning the intrusion detector in the controller would significantly enhance intrusion detection performance. Additionally, leveraging ensemble learning to identify intrusions in the robot controller component while carefully considering potential risks promises satisfactory outcomes in terms of intrusion detection.

Performance study of fuzzy C-mean clustering algorithm based on local density in network security

The development and utilization of network big data is also accompanied by data theft and destruction, so the monitoring of network security is particularly important. Based on this, the study applies the fuzzy C-mean clustering algorithm to the network security model, however, the algorithm has major defects in discrete data processing and the influence of feature weights. Therefore, the study introduces the concept of local density and optimizes the initial clustering center to solve its sensitive defects as well as empirical limitations; at the same time, the study introduces the adaptive methods of fuzzy indicators and feature weighting, and uses the concepts such as fuzzy center-of-mass distribution to avoid problems such as the model converging too fast and not being able to handle discrete data. Finally, the study does a simulation analysis of the performance of each module, and the comparison of the overall algorithm with the rest of the models. The experimental results show that in the comparison of the overall algorithm, its false detection rate decreases by 8.57% in the IDS Dataset dataset, compared to the particle swarm algorithm. Therefore, the adaptive weighted fuzzy C-Means algorithm based on local density proposed in the study can effectively improve the network intrusion detection performance.

A Critical Review of Artificial Intelligence Based Approaches in Intrusion Detection: A Comprehensive Analysis

Intrusion detection (ID) is critical in securing computer networks against various malicious attacks. Recent advancements in machine learning (ML), deep learning (DL), federated learning (FL), and explainable artificial intelligence (XAI) have drawn significant attention as potential approaches for ID. DL-based approaches have shown impressive performance in ID by automatically learning relevant features from data but require significant labelled data and computational resources to train complex models. ML-based approaches require fewer computational resources and labelled data, but their ability to generalize to unseen data is limited. FL is a relatively new approach that enables multiple entities to train a model collectively without exchanging their data, providing privacy and security benefits, making it an attractive option for ID. However, FL-based approaches require more communication resources and additional computation to aggregate models from different entities. XAI is critical for understanding how AI models make decisions, improving interpretability and transparency. While existing literature has explored the strengths and weaknesses of DL, ML, FL, and XAI-based approaches for ID, a significant gap exists in providing a comprehensive analysis of the specific use cases and scenarios where each approach is most suitable. This paper seeks to fill this void by delivering an in-depth review that not only highlights strengths and weaknesses but also offers guidance for selecting the appropriate approach based on the unique ID context and available resources. The selection of an appropriate approach depends on the specific use case, and this work provides insights into which method is best suited for various network sizes, data availability, privacy, and security concerns, thus aiding practitioners in making informed decisions for their ID needs.

Meta learning-based few-shot intrusion detection for 5G-enabled industrial internet

AbstractWith the formation and popularization of the 5G-enabled industrial internet, cybersecurity risks are increasing, and the limited number of attack samples, such as zero-day, leaves a short response time for security protectors, making it substantially more difficult to protect industrial control systems from new types of malicious attacks. Traditional supervised intrusion detection models rely on a large number of samples for training and their performance needs to be improved. Therefore, there is an urgent need for few-shot intrusion detection. Aiming at the above problems, this paper proposes a detection model based on a meta-learning framework, which aims to effectively improve the accuracy and real-time performance of intrusion detection, and designs a meta-learning intrusion detection model containing a sample generation module, a feature mapping module and a feature metric module. Among them, the sample generation module introduces the residual block into the Natural GAN and proposes a new method to generate high-quality antagonistic samples—Res-Natural GAN, which is used to enhance the antagonism of the generated samples and the feature mining degree, to improve the accuracy of malicious traffic detection; the feature mapping module proposes a new attention mechanism, the multi-head fast attention mechanism, which is applied to the encoder structure of the transformer and combined with a parameter optimization algorithm based on particle swarm mutation to shorten the mapping time and improve the real-time performance of the model while mapping the features effectively; the feature metric module proposes a prototype structure based on a prototype storage update algorithm and combines it with a prototype network to achieve correct classification by measuring the Euclidean distance between the detected samples and the class of prototypes, and to shorten the inference time while ensuring the detection accuracy; finally, the three modules are combined to form a real-time meta-learning intrusion detection model. To evaluate the proposed model, five different types of experiments are conducted on multiple public datasets. The experimental results show that the model has higher detection accuracy than the traditional model for both few-shot and zero-shot malicious attacks, and is not only applicable to 5G-enabled industrial internet, but also generalized to different network environments and attack types.

Securing SDN: Hybrid autoencoder-random forest for intrusion detection and attack mitigation

Software Defined Networking (SDN) has revolutionized network administration by providing centralized management through software, enabling traffic adjustment independent of the data plane. Despite the benefits, SDN networks are prone to security threats from external sources, thus necessitating the implementation of security measures. Unfortunately, most existing efforts have been just a simple mapping of earlier solutions into the SDN environments. This paper addresses the problem of SDN security based on deep learning in a purely native SDN environment, where a Deep Learning intrusion detection module is tailored to a native SDN environment. In particular, we propose a hybrid Deep AutoEncoder with a Random Forest classifier model (DAERF) to enhance intrusion detection performance in a native SDN environment. The proposed model is incorporated into a novel adaptive framework for attack mitigation in SDN environments. The proposed framework consists of a three-layer protection mechanism for detecting and preventing attacks. It is based on entropy-based detection, hybrid machine learning in the control layer and proactive services monitoring in the application layer. Experimental results have shown that our DEARF proposed autoencoder model achieved anomaly detection rates in excess of 98% in stand-alone mode as well as when incorporated within the framework, making it highly solution for next generation SDN networks.

Blockchain and explainable AI for enhanced decision making in cyber threat detection

SummaryArtificial Intelligence (AI) based cyber threat detection tools are widely used to process and analyze a large amount of data for improved intrusion detection performance. However, these models are often considered as black box by the cybersecurity experts due to their inability to comprehend or interpret the reasoning behind the decisions. Moreover, AI‐based threat hunting is data‐driven and is usually modeled using the data provided by multiple cloud vendors. This is another critical challenge, as a malicious cloud can provide false information (i.e., insider attacks) and can degrade the threat‐hunting capability. In this paper, we present a blockchain‐enabled eXplainable AI (XAI) for enhancing the decision‐making capability of cyber threat detection in the context of Smart Healthcare Systems. Specifically, first, we use blockchain to validate and store data between multiple cloud vendors by implementing a Clique Proof‐of‐Authority (C‐PoA) consensus. Second, a novel deep learning‐based threat‐hunting model is built by combining Parallel Stacked Long Short Term Memory (PSLSTM) networks with a multi‐head attention mechanism for improved attack detection. The extensive experiment confirms its potential to be used as an enhanced decision support system by cybersecurity analysts.

Hybrid wrapper feature selection method based on genetic algorithm and extreme learning machine for intrusion detection

Intrusion detection systems play a critical role in the mitigation of cyber-attacks on the Internet of Things (IoT) environment. Due to the integration of many devices within the IoT environment, a huge amount of data is generated. The generated data sets in most cases consist of irrelevant and redundant features that affect the performance of the existing intrusion detection systems (IDS). The selection of optimal features plays a critical role in the enhancement of intrusion detection systems. This study proposes a sequential feature selection approach using an optimized extreme learning machine (ELM) with an SVM (support vector machine) classifier. The main challenge of ELM is the selection of the input parameters, which affect its performance. In this study, the genetic algorithm (GA) is used to optimize the weights of ELM to boost its performance. After the optimization, the algorithm is applied as an estimator in the sequential forward selection (wrapper technique) to select key features. The final obtained feature subset is applied for classification using SVM. The IoT_ToN network and UNSWNB15 datasets were used to test the model's performance. The performance of the model was compared with other existing state-of-the-art classifiers such as k-nearest neighbors, gradient boosting, random forest, and decision tree. The model had the best quality of the selected feature subset. The results indicate that the proposed model had a better intrusion detection performance with 99%, and 86% accuracy for IoT_ToN network dataset and UNSWNB15 datasets, respectively. The model can be used as a promising tool for enhancing the classification performance of IDS datasets.

Secure and privacy-preserving intrusion detection in wireless sensor networks: Federated learning with SCNN-Bi-LSTM for enhanced reliability

As the digital landscape expands rapidly due to technological advancements, cybersecurity concerns have become more prevalent. Intrusion Detection Systems (IDSs), which are crucial for identifying unusual network traffic indicative of malicious activity, have become a necessity. These systems can be either hardware or software-based. However, traditional IDS models often fail to adequately protect data privacy and detect complex, unique breaches, particularly within Wireless Sensor Networks (WSNs). To address these limitations, this paper proposes a novel Stacked Convolutional Neural Network and Bidirectional Long Short Term Memory (SCNN-Bi-LSTM) model for intrusion detection in WSNs. This model leverages Federated Learning (FL) to enhance intrusion detection performance and safeguard privacy. The FL-based SCNN-Bi-LSTM model is unique in its approach, allowing multiple sensor nodes to collaboratively train a central global model without revealing private data, thereby alleviating privacy concerns. The deep learning methodology of the SCNN-Bi-LSTM model effectively identifies sophisticated and previously unknown cyber threats by meticulously examining both local and temporal linkages in network patterns. The model has been specifically designed to detect and categorize different types of Denial of Service (DoS) attacks using specialized WSN-DS and CIC-IDS-2017 datasets. Compared to traditional Artificial Deep Neural Network (ADNN) models, our proposed FL-SCNN-Bi-LSTM model demonstrated superior detection rates for complex and unknown attacks, significantly improving IDS performance. The model achieved a notable classification accuracy of approximately 99.9% precision and recall on both datasets, substantially reducing false positives and negatives. Our research underscores the potential of federated learning and deep learning in enhancing the security and privacy of WSNs. The proposed FL-SCNN-Bi-LSTM architecture not only facilitates the identification of complex cyber threats but also exemplifies how deep learning techniques can be employed to bolster intrusion detection systems while preserving user data privacy.

Deep Learning-based Network Security Protection for Scheduling Data in Power Plant Systems

Abstract Scheduling data of power plant systems plays a pivotal role in grid security. In this paper, the intrusion detection model IDP-TSW is constructed by using deep learning technology, feature extraction of raw traffic data based on density peak clustering algorithm and control variable method, and the final classification is realized by softmax. After completing the intrusion detection, for the network malicious intrusion situation further proposed the security protection strategy selection model HMS-BAG based on the Bayesian attack graph, formalized the description of the protection strategy selection problem, and proposed the optimal security protection strategy selection algorithm based on PSO. In the network intrusion detection performance experiments, the performance of the IDP-TSW model proposed in this paper outperforms the Bi-LSTM and CNN+Bi-LSTM models in terms of accuracy, recall, and F1 value. The F1 values for determining normal and abnormal data are 96.57% and 95.75%, respectively, and the precision and recall are also higher than 94%. Detecting Generic and Reconnaissance attacks is more than 90% accurate, but Dos attacks and others are relatively absent. In the network security defense performance experiment, the proposed HMS-BAG model achieved a defense success rate of 94.2% and a defense gain of 170.68.

A Cryptographic based I2ADO-DNN Security Framework for Intrusion Detection in Cloud Systems

Cloud computing's popularity and success are directly related to improvements in the use of Information and Communication Technologies (ICT). The adoption of cloud implementation and services has become crucial due to security and privacy concerns raised by outsourcing data and business applications to the cloud or a third party. To protect the confidentiality and security of cloud networks, a variety of Intrusion Detection System (IDS) frameworks have been developed in the conventional works. However, the main issues with the current works are their lengthy nature, difficulty in intrusion detection, over-fitting, high error rate, and false alarm rates. As a result, the proposed study attempts to create a compact IDS architecture based on cryptography for cloud security. Here, the balanced and normalized dataset is produced using the z-score preprocessing procedure. The best attributes for enhancing intrusion detection accuracy are then selected using an Intelligent Adorn Dragonfly Optimization (IADO). In addition, the trained features are used to classify the normal and attacking data using an Intermittent Deep Neural Network (IDNN) classification model. Finally, the Searchable Encryption (SE) mechanism is applied to ensure the security of cloud data against intruders. In this study, a thorough analysis has been conducted utilizing various parameters to validate the intrusion detection performance of the proposed I2ADO-DNN model.

Novel Network Intrusion Detection Based on Feature Filtering Using FLAME and New Cuckoo Selection in a Genetic Algorithm

Recently, networks have faced a significant challenge in terms of security due to constant unauthorized access by hackers, resulting in the compromise of network user data. To enhance network security, there are various approaches that can be employed, including the utilization of firewalls, encryption, and antivirus software. Among these methods, one type of system that can be implemented is an intrusion detection system (IDS), which actively monitors the network to identify any intrusions. In order to effectively detect any unauthorized or malicious activities, sophisticated techniques such as genetic algorithms, cuckoo searches, and FLAME are employed. This research proposes a novel IDS that aims to improve the detection of intrusions. The proposed IDS initially conducts feature filtration using fuzzy clustering through the local approximation of the membership algorithm (FLAME), which effectively reduces the number of features that need to be analyzed and processed. Subsequently, the system detects attacks by implementing an extended classifier system (XCS) that incorporates a genetic algorithm (GA) to enhance the accuracy of intrusion detection. By incorporating the cuckoo search and selection within GA, while considering different crossover and mutation probabilities, instead of solely relying on traditional GA, it is anticipated that intrusion detection accuracy will be improved. To evaluate the performance of the proposed IDS, it was tested on the KDD99 dataset and compared with several other IDSs that were also tested on the same dataset. The experimental results clearly indicate that the proposed IDS significantly enhances the detection rate (DR) and accuracy while also significantly reducing the false alarm rate (FAR) and these impressive results were 100%, 99.99% and 0.05% respectively. The performance comparisons reveal that, overall, the proposed IDS outperforms several existing IDSs in terms of intrusion detection performance.

Design of Network Intrusion Detection System Using Lion Optimization-Based Feature Selection with Deep Learning Model

In the domain of network security, intrusion detection systems (IDSs) play a vital role in data security. While the utilization of the internet amongst consumers is increasing on a daily basis, the significance of security and privacy preservation of system alerts, due to malicious actions, is also increasing. IDS is a widely executed system that protects computer networks from attacks. For the identification of unknown attacks and anomalies, several Machine Learning (ML) approaches such as Neural Networks (NNs) are explored. However, in real-world applications, the classification performances of these approaches are fluctuant with distinct databases. The major reason for this drawback is the presence of some ineffective or redundant features. So, the current study proposes the Network Intrusion Detection System using a Lion Optimization Feature Selection with a Deep Learning (NIDS-LOFSDL) approach to remedy the aforementioned issue. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL model for the recognition of intrusions. For the purpose of FS, the NIDS-LOFSDL method uses the LOFS technique, which helps in improving the classification results. Furthermore, the attention-based bi-directional long short-term memory (ABiLSTM) system is applied for intrusion detection. In order to enhance the intrusion detection performance of the ABiLSTM algorithm, the gorilla troops optimizer (GTO) is deployed so as to perform hyperparameter tuning. Since trial-and-error manual hyperparameter tuning is a tedious process, the GTO-based hyperparameter tuning process is performed, which demonstrates the novelty of the work. In order to validate the enhanced solution of the NIDS-LOFSDL system in terms of intrusion detection, a comprehensive range of experiments was performed. The simulation values confirm the promising results of the NIDS-LOFSDL system compared to existing DL methodologies, with a maximum accuracy of 96.88% and 96.92% on UNSW-NB15 and AWID datasets, respectively.

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

Information security and threats are a concern in the cyber era. Attacks can be malicious activities. One of them is known as ARP poisoning attack activity, which attacks by falsifying a computer's identity through illegal access to retrieve confidential information in a target computer. Besides, it has also caused service deadlocks in the network. Previous studies have been introduced for the ARP Attack Detection model using rule-based and mining-based. Still, they cannot show optimal detection performance and obtain high false positive results. This paper proposed a detection model for ARP poisoning attacks using a similarity measurement approach adopting cosine similarity. The goal is to obtain measurements of host activities similar to ARP poisoning attacks. The experiment results showed that the model got an accuracy of 97.25%, recall of 96.43%, and precision of 81% with a similarity threshold value of 0.488. Comparison results with previous studies showed higher detection accuracy than previous studies and some classification methods. It shows that the model can improve intrusion detection performance and facilitate network administrators to analyze ARP poisoning attacks in computer networks.

APELID: Enhancing real-time intrusion detection with augmented WGAN and parallel ensemble learning

This paper proposes an AI-powered intrusion detection method that improves intrusion detection performance by increasing the quality of the training set and employing numerous potent AI models. Composed of the Augmented Wasserstein Generative Adversarial Networks (AWGAN) and Parallel Ensemble Learning-based Intrusion Detection (PELID) algorithms, it is referred to as APELID. First, to augment the training set quality, AWGAN combines a clustering algorithm to select representative samples from the majority classes and WGAN to generate more realistic samples from the minority classes. Second, PELID employs a weighted ensemble of multiple efficient AI models in parallel to improve the efficacy of AI-powered intrusion detection. In addition, APELID also incorporates a sandbox-based malware analyzer. It aims to enrich the indicators of compromise for preventing malicious files that have been transferred over the network. Rigorous experiments utilizing well-known datasets, such as CSE-CIC-IDS2018 and NSL-KDD, are conducted in order to evaluate APELID. Hence, it achieves an outstanding F1-score of 99.99% and 99.65% and a remarkably low false negative rate of 0.00% and 0.34%, respectively, which is superior to state-of-the-art methods. In addition, the average PELID-based detection time (i.e., 22.29μs/flow) for a single network traffic flow is fast enough to detect intrusions in real-time.

Improving Performance of Intrusion Detection Using ALO Selected Features and GRU Network

Improving Performance of Intrusion Detection Using ALO Selected Features and GRU Network

A model for multi-attack classification to improve intrusion detection performance using deep learning approaches

This proposed model introduces novel deep learning methodologies. The objective here is to create a reliable intrusion detection mechanism to help identify malicious attacks. Deep learning based solution framework is developed consisting of three approaches. The first approach is Long-Short Term Memory Recurrent Neural Network (LSTM-RNN) with seven optimizer functions such as adamax, SGD, adagrad, adam, RMSprop, nadam and adadelta. The model is evaluated on NSL-KDD dataset and classified multi attack classification. The model has outperformed with adamax optimizer in terms of accuracy, detection rate and low false alarm rate. The results of LSTM-RNN with adamax optimizer is compared with existing shallow machine and deep learning models in terms of accuracy, detection rate and low false alarm rate. The multi model methodology consisting of Recurrent Neural Network (RNN), Long-Short Term Memory Recurrent Neural Network (LSTM-RNN), and Deep Neural Network (DNN). The multi models are evaluated on bench mark datasets such as KDD’99, NSL-KDD, and UNSWNB15 datasets. The models self-learnt the features and classifies the attack classes as multi-attack classification. The models RNN, and LSTM-RNN provide considerable performance compared to other existing methods on KDD’99 and NSL-KDD dataset.