Network Intrusion Detection Model Research Articles

Network Intrusion Detection Based on Conditional Wasserstein Generative Adversarial Network and Cost-Sensitive Stacked Autoencoder

In the field of intrusion detection, there is often a problem of data imbalance, and more and more unknown types of attacks make detection difficult. To resolve above issues, this article proposes a network intrusion detection model called CWGAN-CSSAE, which combines improved conditional Wasserstein Generative Adversarial Network (CWGAN) and cost-sensitive stacked autoencoders (CSSAE). First of all, the CWGAN network that introduces gradient penalty and L2 regularization is used to generate specified minority attack samples to reduce the class imbalance of the training dataset. Secondly, the stacked autoencoder is used to intelligently extract the deep abstract features of the network data. Finally, a cost-sensitive loss function is constructed to give a large misclassification cost to a minority of attack samples. Thus, effective detection of network intrusion attacks can be realized. The experimental results based on KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> , KDDTest-21, and UNSW-NB15 datasets show that the CWGAN-CSSAE network intrusion detection model improves the detection accuracy of minority attacks and unknown attacks. In addition, the method in this article is compared with other existing intrusion detection methods, excellent results have been achieved in performance indicators such as accuracy and F1 score. The accuracy on the above datasets reached 90.34%, 80.78% and 93.27% respectively. The accuracy of U2R on the KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> and KDDTest-21 datasets both reached 42.50%. The accuracy of R2L on the KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> and KDDTest-21 datasets reached 54.39% and 52.51%, respectively. And the F1 score on the above datasets reached 91.01%, 87.18% and 93.99% respectively.

Network Intrusion Detection Based on Supervised Adversarial Variational Auto-Encoder With Regularization

To explore the advantages of adversarial learning and deep learning, we propose a novel network intrusion detection model called SAVAER-DNN, which can not only detect known and unknown attacks but also improve the detection rate of low-frequent attacks. SAVAER is a supervised variational auto-encoder with regularization, which uses WGAN-GP instead of the vanilla GAN to learn the latent distribution of the original data. SAVAER's decoder is used to synthesize samples of low-frequent and unknown attacks, thereby increasing the diversity of training samples and balancing the training data set. SAVAER's encoder is used to initialize the weights of the hidden layers of the DNN and explore high-level feature representations of the original samples. The benchmark NSL-KDD (KDDTest+), NSL-KDD (KDDTest-21) and UNSW-NB15 datasets are used to evaluate the performance of the proposed model. The experimental results show that the proposed SAVAER-DNN is more suitable for data augmentation than the other three well-known data oversampling methods. Moreover, the proposed SAVAER-DNN outperforms eight well-known classification models in detection performance and is more effective in detecting low-frequent and unknown attacks. Furthermore, compared with other state-of-the-art intrusion detection models reported in the IDS literature, the proposed SAVAER-DNN offers better performance in terms of overall accuracy, detection rate, F1 score, and false positive rate.

An Intrusion Detection Model With Hierarchical Attention Mechanism

Network security has always been a hot topic as security and reliability are vital to software and hardware. Network intrusion detection system (NIDS) is an effective solution to the identification of attacks in computer and communication systems. A necessary condition for high-quality intrusion detection is the gathering of useful and precise intrusion information. Machine learning, particularly deep learning, has achieved a lot of success in various fields of industry and academic due to its good ability of feature representation and extraction. In this paper, deep learning methods are integrated into the NIDS. The intrusion activity is regarded as a time-series event and a bidirectional gated recurrent unit (GRU) based network intrusion detection model with hierarchical attention mechanism is presented. The influence of different lengths of previous traffic on the performance is then studied. Some experiments are performed on the dataset UNSW-NB15, in which the proposed hierarchical attention model achieves satisfactory detection accuracy of more than 98.76% and a false alarm rate (FAR) of lower than 1.2%. An attention probability map to reflect the importance of features is then visualized using the attention mechanism. The visualization ability assists in providing an understanding of the varied importance of the same features for different traffic classes and to determine feature selection in the future.

Statistical Based Feature Selection and Ensemble Model for Network Intrusion Detection using Data Mining Technique

In today’s world, Information society, computer networks and their interconnected applications are the emerging technologies. Intrusion Detection System (IDS) is used to distinguish the attitude of the network. Now a days, due to frequent and heavy attacks an Network devices, the Intrusion Detection System has become growing and censorious component to secure Network devices. A huge amount of data is needed to build the perfect Intrusion Detection System. This proposed system focuses on feature selection and ensemble of tree based classification methods to build Intrusion Detection System. The implementation of feature selection is fulfilled by using the NSL-KDD dataset. Statistical based feature selection methods such as Pearson's Correlation, Chi-square, Gain ratio and Symmetrical uncertainty are used to generate four modified datasets. By using that modified datasets the tree based Intrusion Detection models are built using J48, REP Tree and simple CART algorithms. To acquire better prediction of accuracy the algorithms J48, REP tree and simple CART are combined using ensemble method and built perfect tree based Intrusion Detection System.

Deep Neural Network with Dropout for Anomaly Detection in Software Defined Networking

A novel anomaly detection-based NIDS is main demand in the computer networking security for discriminating malicious software attack at the early stage. It monitors and analyzes network traffics, checking abnormal behaviors or attack signatures. The detection rate or accuracy is the prerequisite in the network intrusion detection models, also, developing adaptive and flexible model is a critical challenge regarding to unseen attack. This search paper included the deep neural network (DNN) as anomaly detection model can be used within software defined networking (SDN). Dropout technique is used to prevent DNN model from overfitting. Six features have information about the flow were chosen from NSL-KDD dataset to fit and evaluate this model, these data features could be matched to packet-in message header values, also, these features enable the model to be a good generative, and well perform on intrusion recognition issue with a subset of the data. Cross entropy loss function with SoftMax output layer were used for getting the differences between the two different distribution and mapping to multiple class classification covered five class labels, one is normal and the others are attacks (Dos, R2L, U2L and Probe). Accuracy is a comparative metric utilized for assessing the model performance. The results are promising, where accuracy achieved 92.65%.

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

Network intrusion detection plays a very important role in protecting computer network security. The abnormal traffic detection and analysis by extracting the statistical features of flow is the main analysis method in the field of network intrusion detection. However, these features need to be designed and extracted manually, which often loses the original information of the flow and leads to poor detection efficiency. In this paper, we do not manually design the features of the flow but directly extract the raw data information of the flow for analysis. In addition, we first proposed a new network intrusion detection model named the deep hierarchical network, which integrates the improved LeNet-5 and LSTM neural network structures, while learning the spatial and temporal features of flow. By designing a reasonable network cascading method, we can train our proposed hierarchical network at the same time instead of training two networks separately. In this paper, we use the CICIDS2017 dataset and the CTU dataset. The number and types of flow in these two datasets are large, and the attack types are relatively new. The experimental results show that the performance of the proposed hierarchical network model is significantly better than other network intrusion detection models, which can achieve the best detection accuracy. Finally, we also present an analysis method for traffic features which has an important contribution to abnormal traffic detection and gives the actual meanings of these important features.

An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks

With the popularity and development of network technology and the Internet, intrusion detection systems (IDSs), which can identify attacks, have been developed. Traditional intrusion detection algorithms typically employ mining association rules to identify intrusion behaviors. However, they fail to fully extract the characteristic information of user behaviors and encounter various problems, such as high false alarm rate (FAR), poor generalization capability, and poor timeliness. In this paper, we propose a network intrusion detection model based on a convolutional neural network-IDS (CNN-IDS). Redundant and irrelevant features in the network traffic data are first removed using different dimensionality reduction methods. Features of the dimensionality reduction data are automatically extracted using the CNN, and more effective information for identifying intrusion is extracted by supervised learning. To reduce the computational cost, we convert the original traffic vector format into an image format and use a standard KDD-CUP99 dataset to evaluate the performance of the proposed CNN model. The experimental results indicate that the AC, FAR, and timeliness of the CNN-IDS model are higher than those of traditional algorithms. Therefore, the model we propose has not only research significance but also practical value.

Combined Wireless Network Intrusion Detection Model Based on Deep Learning

In order to effectively detect wireless network intrusion behavior, a combined wireless network intrusion detection model based on deep learning was proposed. First, a feature database was generated by feature mapping, one-hot encoding, and normalization processing. Then, we built a deep belief network (DBN) with the multi-restricted Boltzmann machine (RBM) and the back propagation (BP) network. The BP network layer was connected as an auxiliary layer to the end of the RBM. The back-propagation algorithm was used to fine-tune the weight of the multi-restricted Boltzmann machine. Finally, the support vector machine (SVM) was used to train the detection method. After training, the intrusion detection model, which had the DBN-SVM detection method, was determined. The experimental results show that the detection model has good intrusion detection performance.

Adaptive Network Intrusion Detection and Mitigation Model using Clustering and bayesian Algorithm in a Dynamic Environment

Adaptive Network Intrusion Detection and Mitigation Model using Clustering and bayesian Algorithm in a Dynamic Environment

Ensemble Network Intrusion Detection Model Based on Classification Clustering for Dynamic Environment

Ensemble Network Intrusion Detection Model Based on Classification & Clustering for Dynamic Environment - written by Musyimi Samuel Muthama , Prof. Waweru Mwangi , Dr. Otieno Calvin. published on 2018/02/26 download full article with reference data and citations

基于蝙蝠优化算法的网络入侵检测模型

基于蝙蝠优化算法的网络入侵检测模型

A Novel Intrusion Detection Model for a Massive Network Using Convolutional Neural Networks

More and more network traffic data have brought great challenge to traditional intrusion detection system. The detection performance is tightly related to selected features and classifiers, but traditional feature selection algorithms and classification algorithms can’t perform well in massive data environment. Also the raw traffic data are imbalanced, which has a serious impact on the classification results. In this paper, we propose a novel network intrusion detection model utilizing convolutional neural networks (CNNs). We use CNN to select traffic features from raw data set automatically, and we set the cost function weight coefficient of each class based on its numbers to solve the imbalanced data set problem. The model not only reduces the false alarm rate (FAR) but also improves the accuracy of the class with small numbers. To reduce the calculation cost further, we convert the raw traffic vector format into image format. We use the standard NSL-KDD data set to evaluate the performance of the proposed CNN model. The experimental results show that the accuracy, FAR, and calculation cost of the proposed model perform better than traditional standard algorithms. It is an effective and reliable solution for the intrusion detection of a massive network.

IBBO-LSSVM-based network anomaly intrusion detection

Owing to the variety and complexity of network intrusion, the traditional network anomaly intrusion detection model cannot accurately classify and identify the abnormal intrusion behaviour of the network, resulting in poor performance when detecting the network anomaly intrusion. In order to improve the performance of network intrusion detection, we propose a novel network anomaly intrusion detection method, by means of IBBO-LSSVM. In this paper, the least squares support vector machine is applied to model and analyse the network abnormal intrusion detection, which can capture the relationship between network anomaly intrusion types and its corresponding features. Then, an improved biogeography-based approach is applied to optimise the parameters of the network intrusion detection model. Finally, the model is simulated and evaluated on a standard network anomaly intrusion test database. The accuracy of the network anomaly intrusion detection for the proposed method is higher than 90%, demonstrating that the proposed approach is superior to the traditional methods.

Fuzzy Preferences based STRIDE Threat Model for Network Intrusion Detection

Fuzzy Preferences based STRIDE Threat Model for Network Intrusion Detection

一种基于DBN-SVDD的APT攻击检测方法

由于高级持续性威胁(Advanced Persistent Threat, APT)常用于窃取企业核心资料且带来极其恶劣的影响而引起高度关注。因为APT攻击的攻击方法是对特定的攻击目标长期进行持续性网络攻击，具有极高的隐蔽性、潜伏性等特点；所以传统检测技术无法进行有效识别。目前针对APT攻击的检测方案有沙箱方案、网络异常检测方案、全流量方案这三种检测方案，然而现有的APT攻击检测方法中存在检测准确性较低、需要大量经过标记的样本等缺点。本文提出一种基于深度学习的网络入侵检测模型(DBN-SVDD)，该方法利用DBN进行结构降维、提高检测效率，再利用SVDD对数据集进行识别检测。在NSL-KDD数据集的实验结果表明，该方法的检测率可以达到93.71%。该方法具有无人监督、无需大量标记样本、可以有效处理高维数据等特点，能够有效地应用于APT攻击检测中。 Advanced Persistent Threat (APT) causes high attention for it is frequently used to steal enter-prise core data and bring about extremely harsh effects. The APT attack adopts the attack mode of persistent network attack for a long time, and it has the characteristics of high concealment and latency; therefore, the traditional detection technology cannot be effectively identified. At present, the detection scheme for APT attack has three schemes: sandbox scheme, network anomaly detection scheme and full flow scheme. However, the existing APT attack detection method has low accuracy in the detection, a need for large numbers of marked samples and other shortcomings. In this paper, a network intrusion detection model (DBN-SVDD) based on depth learning is proposed by using the network intrusion detection scheme. This method uses DBN to reduce the structure dimension and improve the detection efficiency. Then, the SVDD is used to detect the data set. The experimental results of NSL-KDD dataset show that the detection rate of this method is high; the method has unmanned supervision; and it can effectively deal with high-dimensional data and so on. It can be effectively applied to APT attack detection.

Research on the Novel Computer Network Intrusion Detection Model based on Improved Particle Swarm Optimization Algorithm

In this paper, we conduct research on the novel computer network intrusion detection model based on improved particle swarm optimization algorithm. TCP flood attack, UDP flood attack, ICMP flood attack, deformity of message attack, the application layer attack is the most typical DDOS attacks, DDOS attacks are also changing to upgrade at the same time, scholars research on DDOS attack defense measures become more and more has the application value and basic practical significance. Network security protection is a comprehensive project, no matter what measures to take that safety is always relative, so as the network security administrator, should change with the network security situation and the security requirements, moderate to adjust security policies, so as to achieve the target. Under this basis, we propose the new perspective on the IDS system that will then enhance the robustness and safetiness of the overall network system.

Network Intrusion Detection Model based on Combination of Fisher Score and ELM Approach

Network Intrusion Detection Model based on Combination of Fisher Score and ELM Approach

Comparison of Data Mining Techniques for Building Network Intrusion Detection Models

Intrusion detection is a detection of encroachment on the personal network or the private network to breach the security systems. This system provides analytical measures to gather information from various networks or computers to identify the cracks in the security systems caused by intruders. The sudden tremendous growth in the amount of internet users network intrusion detection has gained a huge amount of attention/need towards the research of network. Today, cyberattacks have become a vital issue for any organization or individual in the network against preserving significant data and information in their personal computers connected to a network. In this paper, a comparative study was done on two different data mining techniques: decision tree and support vector machine algorithms. These techniques are implemented on the dataset for the experiment, since decision tree C5.0 technique and support vector machine (SVM) in general widely used in intrusion experiment data i.e. KDD CUP99 data set downloaded from UCI repository site. The better performance of C5.0 algorithm in terms of accuracy, sensitivity and specificity error measures are to be proved in this paper. General Terms C5.0 algorithm, SVM algorithm, Classification, Clustering, Network Intrusion, KDD cup99, Cyber-Attacks, DoS, Probe, R2L, U2R.

Network Intrusion Prediction Model based on RBF Features Classification

According to the relationship between feature subset and parameters of RBF neural network, in order to improve the intrusion detection accuracy, it proposed an improved particle swarm optimization neural network of network intrusion detection model. Network feature subset and parameters of RBF neural network were regarded as a particle, through collaboration and information exchange between particles to find the optimal feature subset and parameters of RBF neural network, so as to establish the optimal network intrusion detection model, and using KDD Cup 99 data sets to carry out simulation experiment. The simulation results showed that, IPSO-RBF neural network reduced the feature dimensions, and the better parameters of RBF neural network was obtained then, which is a kind of network intrusion detection model with high detection accuracy and high speed.

A hybrid PSO-SVM model for network intrusion detection

A hybrid PSO-SVM model for network intrusion detection