A Multiple-Layer Representation Learning Model for Network-Based Attack Detection

Abstract

Accurate detection of network-based attacks is crucial to prevent security breaches of information systems. The recent application of deep learning approaches for network intrusion detection has shown promising. However, the challenges remain on how to deal with imbalance data and small samples as well as reducing false alarm rate (FAR). To address these issues, this work has proposed a multiple-layer representation learning model for accurate end-to-end network intrusion detection by combining deep convolutional neural networks (CNN) with gcForest. The contributions of this work lie in 1) a new data encoding scheme based on P-Zigzag to encode network traffic data into two-dimensional gray-scale images for representation learning without loss of original information; 2) The combination of gcForest and CNN allows accurate detection on imbalanced data and small scale data with fewer hyperparamters comparing to most existing deep learning models, which increase computational efficiency. The proposed approach is based on a multiple-layer approach consisting of a coarse layer and a fine layer, in which the coarse layer with the improved CNN model (GoogLeNetNP) focuses on identification of N abnormal classes and a normal class. While in the fine layer, an improved model based on gcForest (caXGBoost) further classifies the abnormal classes into N-1 subclasses. This ensures fine-grained detection of various attacks. The proposed framework has been compared with the existing deep learning models using three real datasets (a new dataset NBC, a combination of UNSW-NB15 and CICIDS2017 consisting of 101 classes). The experimental results show that our proposed method outperforms other single deep learning methods (i.e., AlexNet, VGG19, GoogleNet, InceptionV3, ResNet18) in terms of accuracy, detection rate, and FAR, which demonstrates its effectiveness in detecting fine-grained attacks and handling imbalanced datasets with high-precision and low FAR. INDEX TERMS Network intrusion detection, convolutional neural networks, deep random forests, representation learning.

Network intrusion detection system: A systematic study of machine learning and deep learning approaches

“…Zhang et al 124 proposed a complex multilayer IDS model based on CNN and gcForest. They also proposed a novel P‐Zigzag algorithm for converting the raw data into two‐dimensional greyscale images.…”

Evaluation of Machine Learning Algorithms for Anomaly Detection

“…Zhang et al [12] proposed a network intrusion detection based on a deep hierarchical network and original flow data, using CNN classification to learn spatial features and Long short-term memory (LSTM) classification to learn temporal features, for the CICIDS2017 and CTU datasets. After the classification process by CNN+LSTM, 99.8% accuracy was achieved for the CICIDS2017 dataset, and 98.7% accuracy for the CTU dataset.…”

An Intrusion Detection Model based on a Convolutional Neural Network

“…NSL-KDD was generated to resolve some issues in KDD, especially duplicated records and lack of patterns of several attacks. Chuanlong [21] [14] focuses on intrusion detection using Deep Forest. They preprocess the datasets using based on the P-ZigZag encoding method and apply an inverse discrete cosine transform (IDCT) into the preprocessed datasets.…”

“…It was created based on B-Profile system [12]. After CIC-2017 released, several studies suggest intrusion detection model using CIC-2017 based on ML [13][14]. CIC-2018 is the most up-to-date dataset including common attacks for IDS evaluation.…”