A Hierarchical Intrusion Detection Model Combining Multiple Deep Learning Models With Attention Mechanism

Xu, Hongsheng; Sun, Libo; Fan, Ganglong; Li, W.; Kuang, Guofang

doi:10.1109/access.2023.3290613

Cited by 8 publications

(5 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The results with the CICDDoS2019 dataset showed the superiority of the proposed models under human expertise over most previous works ( [19], [24], [43]) in terms of accuracy, precision, and FPR with 99.80%, 99.98%, and 0.085% for the CNN and 99.76%, 99.99%, and 0.046% for the BiLSTM+LSTM, respectively. However, a DFNN model developed by the authors in [42] demonstrated a slight superiority in accuracy (99.94%) but a lower precision (99.95%).…”

Section: Discussionmentioning

confidence: 70%

“…The results with the CICIDS2017 dataset also proved the efficiency of the proposed framework in intrusion detection and false alarm mitigation. The proposed models under human expertise outperformed the recent works of [24], [25], and [41] in terms of accuracy and precision with 99.76% and 99.60% for the CNN and 99.88% and 99.86% for the BiLSTM+LSTM, respectively. However, the authors of [27] and [29] developed two models that slightly outperformed our models in terms of accuracy and precision, with 99.96% and 99.96% accuracy and precision for the first model and 99.99% and 99.99%, respectively, for the second model.…”

Section: Discussionmentioning

confidence: 78%

“…The simulation method showed a false alarm rate (FAR) of 1.28%. Xu et al [24] developed in their study a CNN-BiLSTM-Attention classifier for intrusion detection. They chose deep learning because of its advantages in processing large-scale and complex data.…”

Section: Wu and Guomentioning

confidence: 99%

See 2 more Smart Citations

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Maiga,

Ataro,

Githinji

2024

IEEE Access

View full text Add to dashboard Cite

Intrusion detection systems (IDS) have seen an increasing number of proposals by researchers utilizing deep learning (DL) to safeguard critical networks. However, they often suffer from high false alarm rates, posing a significant challenge to their deployment in critical networks. This paper presents a comprehensive human-machine framework for mitigating false alarms in DL-based intrusion detection systems. The proposed approach uses probabilistic clustering to enable human-machine collaboration in a synergistic manner. Probabilistic clustering involves regrouping network traffic into clusters based on their probabilities (computed using the DL model). Clusters with high false alarms (H-FAR) are detected, and all traffic falling within them is considered uncertain for efficient classification by the DL model as malicious or benign. They are redirected to human experts to analyze and make a final decision. The proposed framework incorporates a next-generation firewall (NGFW) to help human experts handle the processed traffic efficiently. The proposed framework enhances the performance of DL-based intrusion detection classifiers by reducing false alarms. To validate the proposed concept, assessments were conducted using a customized high-performance convolutional neural network (CNN) and a hybrid recurrent neural network (RNN) model with three open-access benchmark datasets (CICDDoS2019, UNSW-NB15, and CICIDS2017). The evaluation through simulation demonstrated that combining human expertise with deep learning technology can significantly reduce the number of false positives (FNs) and false negatives (FNs) by up to 79.61% and 86.99%, respectively.

show abstract

Section: Discussionmentioning

confidence: 70%

Section: Discussionmentioning

confidence: 78%

See 1 more Smart Citation

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Maiga,

Ataro,

Githinji

2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The CNN architecture involves convolutional layers for feature extraction, pooling layers for dimensionality reduction, and fully connected layers for classification. Activation functions such as Rectified Linear Unit (ReLU) are applied to introduce non-linearity to the model [2]. Parameters like the number of hot indicators and the number of failed login attempts from the KDD Cup 1999 dataset contribute to its success [1].…”

Section: ) Convolutional Neural Network (Cnn)mentioning

confidence: 99%

SecureNet: Network Intrusion Detection using Machine Learning and Deep Learning Techniques

Takale,

Patil,

Lonikar

et al. 2024

IJRASET

View full text Add to dashboard Cite

In the ever-evolving landscape of cybersecurity, the need for robust intrusion detection systems has become paramount. This paper introduces a cutting-edge intrusion detection algorithm designed to enhance network security through the integration of advanced machine learning and deep learning methodologies. The proposed algorithm capitalizes on the strengths of both paradigms to achieve a comprehensive and adaptive approach to identifying malicious activities within a network. This research focuses on enhancing network security through the development and evaluation of a novel intrusion detection system leveraging both deep learning and traditional machine learning approaches. Utilizing the NSL-KDD dataset, we employ the Long Short-Term Memory (LSTM) model, a superior version of Recurrent Neural Networks (RNNs), and the K-Nearest Neighbors (KNN) algorithm for binary and multi-class classification of network intrusion anomalies. The LSTM model excels in capturing temporal dependencies, enabling the detection of nuanced sequential patterns, while the KNN algorithm contributes to a comprehensive classification framework. Experimental results demonstrate the effectiveness of the hybrid methodology, showcasing improved accuracy, precision, and recall compared to traditional methods. This research underscores the potential of integrating deep learning and classical machine learning techniques to bolster the capabilities of intrusion detection systems in safeguarding against evolving cyber threats

show abstract

“…• BiLSTM: This model employs two LSTMs, one of which processes the sequence forward and the other in reverse. Through this bidirectional process, BiLSTM increases the amount of information available to the network, which can be valuable in traffic classification problems where comprehending relationships between various traffic features is essential [43]. Figure 6 shows the architecture of the BiLSTM model.…”

Section: Deep Learning Model Selectionmentioning

confidence: 99%

A Novel Traffic Classification Approach by Employing Deep Learning on Software-Defined Networking

Nuñez-Agurto,

Fuertes,

Marrone

et al. 2024

Future Internet

View full text Add to dashboard Cite

The ever-increasing diversity of Internet applications and the rapid evolution of network infrastructure due to emerging technologies have made network management more challenging. Effective traffic classification is critical for efficiently managing network resources and aligning with service quality and security demands. The centralized controller of software-defined networking provides a comprehensive network view, simplifying traffic analysis and offering direct programmability features. When combined with deep learning techniques, these characteristics enable the incorporation of intelligence into networks, leading to optimization and improved network management and maintenance. Therefore, this research aims to develop a model for traffic classification by application types and network attacks using deep learning techniques to enhance the quality of service and security in software-defined networking. The SEMMA method is employed to deploy the model, and the classifiers are trained with four algorithms, namely LSTM, BiLSTM, GRU, and BiGRU, using selected features from two public datasets. These results underscore the remarkable effectiveness of the GRU model in traffic classification. Hence, the outcomes achieved in this research surpass state-of-the-art methods and showcase the effectiveness of a deep learning model within a traffic classification in an SDN environment.

show abstract

A Hierarchical Intrusion Detection Model Combining Multiple Deep Learning Models With Attention Mechanism

Cited by 8 publications

References 35 publications

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

SecureNet: Network Intrusion Detection using Machine Learning and Deep Learning Techniques

A Novel Traffic Classification Approach by Employing Deep Learning on Software-Defined Networking

Contact Info

Product

Resources

About