A Novel Intrusion Detection Model for a Massive Network Using Convolutional Neural Networks

Wu, Kehe; Chen, Zuge; Li, Wei

doi:10.1109/access.2018.2868993

Cited by 243 publications

(133 citation statements)

References 37 publications

Supporting

Mentioning

119

Contrasting

Order By: Relevance

“…In [19], Kehe Wu et al present an IDS based on CNN for multi-class traffic classification. The proposed neural network model has been validated with flow-level features from the NSL-KDD dataset encoded into 11x11 arrays.…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…Convolutional Neural Networks (CNNs), a specific DL technique, have grown in popularity in recent times leading to major innovations in computer vision [6]- [8] and Natural Language Processing [9], as well as various niche areas such as protein binding prediction [10], [11], machine vibration analysis [12] and medical signal processing [13]. Whilst their use is still under-researched in cybersecurity generally, the application of CNNs has advanced the state-of-the-art in certain specific scenarios such as malware detection [14]- [17], code analysis [18], network traffic analysis [4], [19]- [21] and intrusion detection in industrial control systems [22]. These successes, combined with the benefits of CNN with respect to reduced feature engineering and high detection accuracy, motivate us to employ CNNs in our work.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Doriguzzi-Corin

Millar

Scott-Hayward

et al. 2020

IEEE Trans. Netw. Serv. Manage.

228

105

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks are one of the most harmful threats in today's Internet, disrupting the availability of essential services. The challenge of DDoS detection is the combination of attack approaches coupled with the volume of live traffic to be analysed. In this paper, we present a practical, lightweight deep learning DDoS detection system called LUCID, which exploits the properties of Convolutional Neural Networks (CNNs) to classify traffic flows as either malicious or benign. We make four main contributions; (1) an innovative application of a CNN to detect DDoS traffic with low processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce traffic observations for online attack detection, (3) an activation analysis to explain LUCID's DDoS classification, and (4) an empirical validation of the solution on a resource-constrained hardware platform. Using the latest datasets, LUCID matches existing stateof-the-art detection accuracy whilst presenting a 40x reduction in processing time, as compared to the state-of-the-art. With our evaluation results, we prove that the proposed approach is suitable for effective DDoS detection in resource-constrained operational environments.

show abstract

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Doriguzzi-Corin

Millar

Scott-Hayward

et al. 2020

IEEE Trans. Netw. Serv. Manage.

228

105

View full text Add to dashboard Cite

show abstract

“…For the above experimental dataset, we first carried out one-hot coding, transforming non numerical variables into computable numerical forms, and expanding the original 41 dimensions to 122 dimensions, and then carrying out Z-score standardization. If the feature filtering method in [43] was used directly here, then the attribute with the least correlation would be removed from the above 122-dimensional dataset, and the 121-dimensional dataset will be converted into a series of single channel images of 11 × 11. However, it will reduce the amount of original information and cause information loss.…”

Section: Experimental Results and Analysismentioning

confidence: 99%

“…GINI-GBDTPSO [35] 86.10 CNN [43] 79.48 LSTM [44] 92.00 DMNB [45] 96.50 DBN-SVM [46] 92.84 TUIDS [47] 96.55 RNN-IDS [48] 81.29 Our Proposed IDS 99.529 From Tables 4 and 5, our proposed IDS (i.e., the IDS based on the S-ResNet) has higher accuracy than the other IDSs on the NSL-KDD dataset, and higher recall than the other IDSs for each category on the NSL-KDD dataset, especially for R2L and U2R attacks.…”

Section: Idss Accuracy (%)mentioning

confidence: 99%

An Intrusion Detection System Based on a Simplified Residual Network

Xiao

2019

Information

View full text Add to dashboard Cite

Residual networks (ResNets) are prone to over-fitting for low-dimensional and small-scale datasets. And the existing intrusion detection systems (IDSs) fail to provide better performance, especially for remote-to-local (R2L) and user-to-root (U2R) attacks. To overcome these problems, a simplified residual network (S-ResNet) is proposed in this paper, which consists of several cascaded, simplified residual blocks. Compared with the original residual block, the simplified residual block deletes a weight layer and two batch normalization (BN) layers, adds a pooling layer, and replaces the rectified linear unit (ReLU) function with the parametric rectified linear unit (PReLU) function. Based on the S-ResNet, a novel IDS was proposed in this paper, which includes a data preprocessing module, a random oversampling module, a S-Resnet layer, a full connection layer and a Softmax layer. The experimental results on the NSL-KDD dataset show that the IDS based on the S-ResNet has a higher accuracy, recall and F1-score than the equal scale ResNet-based IDS, especially for R2L and U2R attacks. And the former has faster convergence velocity than the latter. It proves that the S-ResNet reduces the complexity of the network and effectively prevents over-fitting; thus, it is more suitable for low-dimensional and small-scale datasets than ResNet. Furthermore, the experimental results on the NSL-KDD datasets also show that the IDS based on the S-ResNet achieves better performance in terms of accuracy and recall compared to the existing IDSs, especially for R2L and U2R attacks.

show abstract

“…It is possible modifying the CNN model structure for the sake of achieving the goal. In addition to that, due to the fact that the detection time is also key to intrusion detection, it is necessary to ensure that the model is capable of meeting the time requirements of the IDS when enhancing the accuracy of detection [46]. For other information please refer to [47].…”

Section: Deep Network For Supervised or Discriminative Learningmentioning

confidence: 99%

Survey on intrusion detection systems based on deep learning

Lateef

Al-Janabi

Al‐Khateeb

2019

PEN

View full text Add to dashboard Cite

Intrusion Detection Systems (IDSs) have a significant role in all networks and information systems in the world to earn the required security guarantee. IDS is one of the solutions used to reduce malicious attacks. As attackers always changing their techniques of attack and find alternative attack methods, IDS must also evolve in response by adopting more sophisticated methods of detection. The huge growth in the data and the significant advances in computer hardware technologies resulted in the new studies existence in the deep learning field, including intrusion detection. Deep learning is sub-field of Machine Learning (ML) methods that are based on learning data representations. In this paper, a detailed survey of various deep learning methods applied in IDSs is given first. Then, a deep learning classification scheme is presented and the main works that have been reported in the deep learning works is summarized. Utilizing this approach, we have provided a taxonomy survey on the available deep architectures and algorithms in these works and classify those algorithms to three classes, which are: discriminative, hybrid and generative. After that, chosen deep learning applications are reviewed in a wide range of fields of intrusion detection. Finally, popular types of datasets and frameworks are discussed.

show abstract

A Novel Intrusion Detection Model for a Massive Network Using Convolutional Neural Networks

Cited by 243 publications

References 37 publications

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

An Intrusion Detection System Based on a Simplified Residual Network

Survey on intrusion detection systems based on deep learning

Contact Info

Product

Resources

About