AE-CGAN Model based High Performance Network Intrusion Detection System
Source abstract
Abstract
In this paper, a high-performance network intrusion detection system based on deep learning is proposed for situations in which there are significant imbalances between normal and abnormal traffic. Based on the unsupervised learning models autoencoder (AE) and the generative adversarial networks (GAN) model during deep learning, the study aim is to solve the imbalance of data and intrusion detection of high performance. The AE-CGAN (autoencoder-conditional GAN) model is proposed to improve the performance of intrusion detection. This model oversamples rare classes based on the GAN model in order to solve the performance degradation caused by data imbalance after processing the characteristics of the data to a lower level using the autoencoder model. To measure the performance of the AE-CGAN model, data is classified using random forest (RF), a typical machine learning classification algorithm. In this experiment, we used the canadian institute for cybersecurity intrusion detection system (CICIDS)2017 dataset, the latest public dataset of network intrusion detection system (NIDS), and compared the three models to confirm efficacy of the proposed model. We compared the performance of three types of models. These included single-RF, a classification model using only a classification algorithm, AE-RF which is processed by classifying data features, and the AE-CGAN model which is classified after solving the data feature processing and data imbalance. Experimental results showed that the performance of the AE-CGAN model proposed in this paper was the highest. In particular, when the data were unbalanced, the performances of recall and F1 score, which are more accurate performance indicators, were 93.29% and 95.38%, respectively. The AE-CGAN model showed much better performance.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Engineering, Keimyung University, Daegu 42601, Korea
Funding
National Research Foundation of Korea (NRF), funded by the Ministry of Education, Science and Technology
References (34)
Show source-provided references
1. Distributed Abnormal Behavior Detection Approach Based on Deep Belief Network and Ensemble SVM Using Spark10.1109/ACCESS.2018.2875045 ↗
2. Amoli, P.V., and Hämäläinen, T. (2013, January 7–8). A real time unsupervised NIDS for detecting unknown and encrypted network attacks in high speed network. Proceedings of the 2013 IEEE International Workshop on Measurements & Networking (M&N), Naples, Italy.10.1109/IWMN.2013.6663794 ↗
3. Lee, C.H. (2002). A Study on the Normal Data Extraction Algorithm for Network Intrusion Detection System Learning Data Optimization, ETRI.
4. Bitaab, M., and Hashemi, S. (2017, January 6–7). Hybrid Intrusion Detection: Combining Decision Tree and Gaussian Mixture Model. Proceedings of the 2017 14th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC), Shiraz, Iran.10.1109/ISCISC.2017.8488375 ↗
5. Performance Comparison of Support Vector Machine, Random Forest, and Extreme Learning Machine for Intrusion Detection10.1109/ACCESS.2018.2841987 ↗
6. A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks10.1109/ACCESS.2017.2762418 ↗
7. Lin, W., Lin, H., Wang, P., Wu, B., and Tsai, J. (2018, January 13–17). Using Convolutional Neural Networks to Network Intrusion Detection for Cyber Threats. Proceedings of the IEEE International Conference on Applied System Innovation 2018, Chiba, Japan.10.1109/ICASI.2018.8394474 ↗
8. (2018, June 05). KDD Cup 1999 Data. Available online: http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html.
9. (2018, June 10). NSL-KDD Dataset. Available online: https://www.unb.ca/cic/datasets/nsl.html.
10. Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 8–10). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, Singapore.10.5220/0006639801080116 ↗
11. Effective Feature Extraction via Stacked Sparse Autoencoder to Improve Intrusion Detection System10.1109/ACCESS.2018.2858277 ↗
12. Divekar, A., Parekh, M., Savla, V., Mishra, R., and Shirole, M. (2018, January 25–27). Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives. Proceedings of the 2018 IEEE 3rd International Conference on Computing, Communication and Security (ICCCS), Kathmandu, Nepal.10.1109/CCCS.2018.8586840 ↗
13. (2018, June 20). Intrusion Detection Evaluation Dataset (CICIDS2017). Available online: https://www.unb.ca/cic/datasets/ids-2017.html.
14. Zhu, J., Mu, J., Wei, D., Feng, B., Wang, Y., and Yin, K. (2017, January 6–8). A spatial correlation-based hybrid method for intrusion detection. Proceedings of the 2017 IEEE 9th International Conference on Communication Software and Networks (ICCSN), Guangzhou, China.10.1109/ICCSN.2017.8230280 ↗
15. Sonawane, H.A., and Pattewar, T.M. (2015, January 2–4). A comparative performance evaluation of intrusion detection based on neural network and PCA. Proceedings of the 2015 International Conference on Communications and Signal Processing (ICCSP), Melmaruvathur, India.10.1109/ICCSP.2015.7322612 ↗
16. Deep Learning Approach Combining Sparse Autoencoder With SVM for Network Intrusion Detection10.1109/ACCESS.2018.2869577 ↗
17. Introducing Deep Learning Self-Adaptive Misuse Network Intrusion Detection Systems10.1109/ACCESS.2019.2893871 ↗
18. Comparative Study of Deep Learning Models for Network Intrusion Detection
19. SMOTE: Synthetic Minority Over-sampling Technique10.1613/jair.953 ↗
20. Qazi, N., and Raza, K. (2012, January 28–30). Effect of Feature Selection, SMOTE and under Sampling on Class Imbalance Classification. Proceedings of the International Conference on Computer Modelling and Simulation, Cambridge, UK.10.1109/UKSim.2012.116 ↗
21. Yan, B.H., Han, G.D., Sun, M.D., and Ye, S.Z. (2017, January 13–16). A Novel Region Adaptive SMOTE Algorithm for Intrusion Detection on Imbalanced Problem. Proceedings of the 2017 3rd IEEE International Conference on Computer and Communications (ICCC), Chengdu, China.10.1109/CompComm.2017.8322749 ↗
22. Sun, Y., and Liu, F. (2016, January 14–17). SMOTE-NCL: A Re-Sampling Method with Filter for Network Intrusion Detection. Proceedings of the 2016 2nd IEEE International Conference on Computer and Communications (ICCC), Chengdu, China.
23. Lin, Z., Shi, Y., and Xue, Z. (2019). IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection. arXiv.
24. Kunang, Y.N., Nurmaini, S., Stiawan, D., Zarkasi, A., and Jasmir, F. (2018, January 2–4). Automatic Features Extraction Using Autoencoder in Intrusion Detection System. Proceedings of the 2018 International Conference on Electrical Engineering and Computer Science (ICECOS), Pangkal Pinang, Indonesia.10.1109/ICECOS.2018.8605181 ↗
25. Wang, X., and Wang, L. (2017, January 9–10). Research on Intrusion Detection Based on Feature Extraction of Autoencoder and the Improved K-Means Algorithm. Proceedings of the 2017 10th International Symposium on Computational Intelligence and Design (ISCID), Hangzhou, China.10.1109/ISCID.2017.170 ↗
26. Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014, January 8–13). Generative Adversarial Nets. Proceedings of the Neural Information Processing Systems Conference, Montreal, QC, CA.
27. Usama, M., Asim, M., Latif, S., Qadir, J., and Fuqaha, A.A. (2019, January 24–28). Generative Adversarial Networks for Launching and Thwarting Adversarial Attacks on Network Intrusion Detection Systems. Proceedings of the The 15th International Conference on Wireless Communications and Mobile Computing Machine learning Workshop, Tangier, Morocco.10.1109/IWCMC.2019.8766353 ↗
28. Park, K., Song, Y., and Cheong, Y. (2018, January 26–29). Classification of Attack Types for Intrusion Detection Systems Using a Machine Learning Algorithm. Proceedings of the 2018 IEEE Fourth International Conference on Big Data Computing Service and Applications (Big Data Service), Bamberg, Germany.10.1109/BigDataService.2018.00050 ↗
29. Mizianty, M., Kurgan, L., and Ogiela, M. (2008, January 11–13). Comparative Analysis of the Impact of Discretization on the Classification with Naïve Bayes and Semi-Naïve Bayes Classifiers. Proceedings of the 2008 Seventh International Conference on Machine Learning and Applications, San Diego, CA, USA.10.1109/ICMLA.2008.29 ↗
30. (2018, September 07). Description of Kyoto University Benchmark Data. Available online: http://www.takakura.com/Kyoto_data/BenchmarkData-Description-v5.pdf.
31. (2018, August 20). Intrusion Detection Evaluation Dataset (ISCXIDS2012). Available online: https://iscxdownloads.cs.unb.ca/iscxdownloads/ISCX-IDS-2012/#ISCX-IDS-2012.
32. (2019, April 08). The UNSW-NB15 Dataset Description. Available online: https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/.
33. Othman, Z.A., and Eljadi, E.E. (2011, January 17–19). Network anomaly detection tools based on association rules. Proceedings of the 2011 International Conference on Electrical Engineering and Informatics, Bandung, Indonesia.10.1109/ICEEI.2011.6021705 ↗
34. (2018, March 12). Confusion Matrix. Available online: https://en.wikipedia.org/wiki/Confusion_matrix.