Network Intrusion Traffic Detection Based on Feature Extraction
Source abstract
Abstract
With the increasing dimensionality of network traffic, extracting effective traffic features and improving the identification accuracy of different intrusion traffic have become critical in intrusion detection systems (IDS). However, both unsupervised and semisupervised anomalous traffic detection methods suffer from the drawback of ignoring potential correlations between features, resulting in an analysis that is not an optimal set. Therefore, in order to extract more representative traffic features as well as to improve the accuracy of traffic identification, this paper proposes a feature dimensionality reduction method combining principal component analysis and Hotelling’s T2 and a multilayer convolutional bidirectional long short-term memory (MSC_BiLSTM) classifier model for network traffic intrusion detection. This method reduces the parameters and redundancy of the model by feature extraction and extracts the dependent features between the data by a bidirectional long short-term memory (BiLSTM) network, which fully considers the influence between the before and after features. The network traffic is first characteristically downscaled by principal component analysis (PCA), and then the downscaled principal components are used as input to Hotelling’s T2 to compare the differences between groups. For datasets with outliers, Hotelling’s T2 can help identify the groups where the outliers are located and quantitatively measure the extent of the outliers. Finally, a multilayer convolutional neural network and a BiLSTM network are used to extract the spatial and temporal features of network traffic data. The empirical consequences exhibit that the suggested approach in this manuscript attains superior outcomes in precision, recall and F1-score juxtaposed with the prevailing techniques. The results show that the intrusion detection accuracy, precision, and F1-score of the proposed MSC_BiLSTM model for the CIC-IDS 2017 dataset are 98.71%, 95.97%, and 90.22%.
Source: openalex_inverted_index · Quality: candidate unverified · Source record ↗
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (34)
Show source-provided references
1. Ensemble feature selection using distance-based supervised and unsupervised methods in binary classification10.1016/j.eswa.2022.116794 ↗
2. Supervised, unsupervised, and semi-supervised feature selection: A review on gene selection10.1109/TCBB.2015.2478454 ↗
3. Dimensionality reduction with IG-PCA and ensemble classifier for network intrusion detection10.1016/j.comnet.2018.11.010 ↗
4. Detecting web attacks with end-to-end deep learning10.1186/s13174-019-0115-x ↗
5. MSML: A novel multi-level semi-supervised machine learning framework for intrusion detection system10.1109/JIOT.2018.2873125 ↗
6. Cyber intrusion detection by combined feature selection algorithm10.1016/j.jisa.2018.11.007 ↗
7. Semi-supervised multivariate statistical network monitoring for learning security threats10.1109/TIFS.2019.2894358 ↗
8. Network abnormal traffic detection model based on semi-supervised deep reinforcement learning10.1109/TNSM.2021.3120804 ↗
9. Nearest neighbors-based density peaks approach to intrusion detection10.1016/j.chaos.2018.03.010 ↗
10. An evolutionary computation based feature selection method for intrusion detection10.1155/2018/2492956 ↗
11. A novel approach to intrusion detection using SVM ensemble with feature augmentation10.1016/j.cose.2019.05.022 ↗
12. A novel statistical technique for intrusion detection systems10.1016/j.future.2017.01.029 ↗
13. Computational neural network regression model for host based intrusion detection system10.1016/j.pisc.2016.04.005 ↗
14. Autoencoder-based network anomaly detection
15. Intrusion detection model based on ICA algorithm and deep neural network
16. Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM10.1007/s10489-021-02205-9 ↗
17. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset10.1109/ACCESS.2020.2972627 ↗
18. A mechanism for detecting the intruder in the network through a stacking dilated CNN model10.1155/2022/1955009 ↗
19. Toward an efficient automatic self-augmentation labeling tool for intrusion detection based on a semi-supervised approach10.3390/app12147189 ↗
20. A real-time adaptive network intrusion detection for streaming data: A hybrid approach10.1007/s00521-021-06786-x ↗
21. Building an intrusion detection system to detect atypical cyberattack flows10.1109/ACCESS.2021.3093830 ↗
22. An improved LSTM network intrusion detection method
23. A simple recurrent unit model based intrusion detection system with DCGAN10.1109/ACCESS.2019.2922692 ↗
24. CNN-LSTM: Hybrid deep neural network for network intrusion detection system10.1109/ACCESS.2022.3206425 ↗
25. Exploiting the auto-encoder residual error for intrusion detection
26. Attack’s feature selection-based network intrusion detection system using fuzzy control language10.1007/s40815-016-0160-6 ↗
27. Principal component analysis: A natural approach to data exploration10.1145/3447755 ↗
28. Poly logarithmic naive bayes intrusion detection system using linear stable PCA feature extraction10.1007/s11277-022-09701-2 ↗
29. Multiview PCA: A methodology of feature extraction and dimension reduction for high-order data10.1109/TCYB.2021.3106485 ↗
30. Are principal components with estimated parameters feasible in multivariate process control?10.1002/qre.3193 ↗
31. Analyzing the performance of long short-term memory architectures for malware detection models10.1002/cpe.7581 ↗
32. A review of the advancement in intrusion detection datasets10.1016/j.procs.2020.03.330 ↗
33. Toward generating a new intrusion detection dataset and intrusion traffic characterization10.5220/0006639801080116 ↗
34. Feature reduction through data preprocessing for intrusion detection in IoT networks