Hierarchical LSTM-Based Network Intrusion Detection System Using Hybrid Classification
Source abstract
Abstract
Most existing network intrusion detection systems (NIDSs) perform intrusion detection using only a partial packet data of fixed size, but they suffer to increase the detection rate. In this study, in order to find the cause of a limited detection rate, accurate intrusion detection performance was analyzed by adjusting the amount of information used as features according to the size of the packet and length of the session. The results indicate that the total packet data and all packets in the session should be used for the maximum detection rate. However, existing NIDS cannot be extended to use all packet data of each session because the model could be too large owing to the excessive number of features, hampering realistic training and classification speeds. Therefore, in this paper, we present a novel approach for the classifier of NIDSs. The proposed NIDS can effectively handle the entire packet information using the hierarchical long short-term memory and achieves higher detection accuracy than existing methods. Performance evaluation confirms that detection performance can be greatly improved compared to existing NIDSs that use only partial packet information. The proposed NIDS achieves a detection rate of 95.16% and 99.70% when the existing NIDS show the highest detection rate of 93.49% and 98.31% based on the F1-score using two datasets. The proposed method can improve the limitations of existing NIDS and safeguard the network from malicious users by utilizing information on the entire packet.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Network Packet Processing and Optimization
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information and Communication Engineering, Yeungnam University, Gyeongsan 38541, Republic of Korea
Funding
National Research Foundation of Korea
References (29)
Show source-provided references
1. Wang, D., He, A., Castiglione, B., Gupta, B., Karuppiah, M., and Wu, L. (2022). PCNNCEC: Efficient and Privacy-Preserving Convolutional Neural Network Inference Based on Cloud-Edge-Client Collaboration. IEEE Trans. Netw. Sci. Eng.10.1109/TNSE.2022.3177755 ↗
2. Vigna, G., Kruegel, C., and Jonsson, E. (2003). Recent Advances in Intrusion Detection, Springer.10.1007/b13476 ↗
3. The use of computational intelligence in intrusion detection systems: A review10.1016/j.asoc.2009.06.019 ↗
4. Ektefa, M., Memar, S., Sidi, F., and Affendey, L.S. (2010, January 17–18). Intrusion detection using data mining techniques. Proceedings of the 2010 Information Retrieval & Knowledge Management (CAMP), Shah Alam, Malaysia.10.1109/INFRKM.2010.5466919 ↗
5. HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection10.1109/ACCESS.2017.2780250 ↗
6. Bilge, L., and Dumitras, T. (2012, January 16). Before we knew it: An empirical study of zero-day attacks in the real world. Proceedings of the 2012 ACM Conference on Computer and Communications Security, Raleigh, NC, USA.10.1145/2382196.2382284 ↗
7. Deep Learning Approach Combining Sparse Autoencoder With SVM for Network Intrusion Detection10.1109/ACCESS.2018.2869577 ↗
8. Long short-term memory10.1162/neco.1997.9.8.1735 ↗
9. A dual-LSTM framework combining change point detection and remaining useful life prediction10.1016/j.ress.2020.107257 ↗
10. An Effective Two-Step Intrusion Detection Approach Based on Binary Classification and k-NN10.1109/ACCESS.2017.2787719 ↗
11. Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. (2009, January 8–10). A Detailed Analysis of the KDD CUP 99 Data Set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), Ottawa, ON, Canada.10.1109/CISDA.2009.5356528 ↗
12. Toward developing a systematic approach to generate benchmark datasets for intrusion detection10.1016/j.cose.2011.12.012 ↗
13. Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22–24). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 2018 4th International Conference on Information Systems Security and Privacy (ICISSP), Funchal, Portugal.10.5220/0006639801080116 ↗
14. Soheily-Khah, S., Marteau, P., and Béchet, N. (2018, January 8–10). Intrusion Detection in Network Systems Through Hybrid Supervised and Unsupervised Machine Learning Process: A Case Study on the ISCX Dataset. Proceedings of the 1st International Conference on Data Intelligence and Security (ICDIS), South Padre Island, TX, USA.10.1109/ICDIS.2018.00043 ↗
15. Mishra, S. (2022). An Optimized Gradient Boost Decision Tree Using Enhanced African Buffalo Optimization Method for Cyber Security Intrusion Detection. Appl. Sci., 12.10.3390/app122412591 ↗
16. Sharafaldin, I., Lashkari, A.H., Hakak, S., and Ghorbani, A.A. (2019, January 1–3). Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy. Proceedings of the IEEE 53rd International Carnahan Conference on Security Technology, Chennai, India.10.1109/CCST.2019.8888419 ↗
17. Lashkari, A.H., Draper-Gil, G., Mamun, M., and Ghorbani, A.A. (2017, January 19–21). Characterization of Tor Traffic Using Time Based Features. Proceedings of the 2017 3rd International Conference on Information System Security and Privacy, SCITEPRESS, Porto, Portugal.
18. Drapper-Gil, G., Lashkari, A.H., Mamun, M., and Ghorbani, A.A. (2016, January 19–21). Characterization of Encrypted and VPN Traffic Using Time-Related Features. Proceedings of the 2016 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016), Rome, Italy.10.5220/0005740704070414 ↗
19. Sahu, S., and Mehtre, B.M. (2015, January 10–13). Network intrusion detection system using J48 Decision Tree. Proceedings of the 2015 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Kochi, India.10.1109/ICACCI.2015.7275914 ↗
20. (2023, January 13). Description of Kyoto University Benchmark Data. Available online: https://www.takakura.com/Kyoto_data/BenchmarkData-Description-v5.pdf.
21. TSE-IDS: A Two-Stage Classifier Ensemble for Intelligent Anomaly-Based Intrusion Detection System10.1109/ACCESS.2019.2928048 ↗
22. Deep Learning-Based Intrusion Detection With Adversaries10.1109/ACCESS.2018.2854599 ↗
23. Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors10.1109/JSAC.2021.3087242 ↗
24. Gu, J., Zhu, M., Zhou, Z., Zhang, F., Lin, Z., Zhang, Q., and Breternitz, M. (2014, January 25–26). Implementation and evaluation of deep neural networks (DNN) on mainstream heterogeneous systems. Proceedings of the 2014 5th Asia-Pacific Workshop on Systems (APSys′14), New York, NY, USA.10.1145/2637166.2637229 ↗
25. Application of the residue number system to reduce hardware costs of the convolutional neural network implementation10.1016/j.matcom.2020.04.031 ↗
26. Oriented Stochastic Loss Descent Algorithm to Train Very Deep Multi-Layer Neural Networks Without Vanishing Gradients10.1016/j.knosys.2021.107391 ↗
27. Extreme learning machine: Theory and applications10.1016/j.neucom.2005.12.126 ↗
28. An Introduction to ROC Analysis10.1016/j.patrec.2005.10.010 ↗
29. Gautam, S., Henry, A., Zuhair, M., Rashid, M., Javed, A.R., and Maddikunta, P.K.R. (2022). A Composite Approach of Intrusion Detection Systems: Hybrid RNN and Correlation-Based Feature Optimization. Electronics, 11.10.3390/electronics11213529 ↗