An Attention-Based Convolutional Neural Network for Intrusion Detection Model

Abstract

Network technology has had a distinctive impact on the entire human civilization and has become an important factor of production in many countries and regions. However, with the widespread popularity of network technology, security flaws have been scattered in various fields, and potential crises may break out by attackers at any time. Therefore, it is crucial to establish a traffic monitoring mechanism for network systems. Some researchers have already implemented intrusion detection models by convolutional neural networks (CNNs) combined with attention mechanisms and achieved good results. However, few attempts have been made to improve the computational efficiency of the model by organizing the appropriate image structure, and the integration of attention mechanisms could be further enhanced. In this study, an attention-based CNN intrusion detection model has been proposed. Together with the image generation methods described in this paper, an efficient and accurate processing flow is formed. To optimize the use of the feature information in the experiments, the feature fields in the experimental images were arranged according to the results of their importance analysis. And a more integrated attention mechanism has been applied to the CNN for building the detection model. A series of comparative experiments were conducted on a subset of the CSE-CIC-IDS2018 dataset, and the results show that the detection process and model proposed in this paper can swiftly complete the detection procedure while maintaining high accuracy.

CNN Channel Attention Intrusion Detection System Using NSL-KDD Dataset

“…CNN-based IDS techniques are categorized using a brand-new system. The study found that the hybrid auto-encoder with CNN achieved 84.39% accuracy on the NSL-KDD dataset [8,9]. Furthermore, Al-Turaiki et al's research [10] presents a novel anomaly-based network intrusion detection method.…”

“…Binary features (7,12,14,20,21,22) describe attributes with two states, while categorical features (2, 3, 4, 42) reflect qualitative variables with distinct categories. Discrete features (8,9,15,(23)(24)(25)(26)(27)(28)(29)(30)(31)(32)(33)(34)(35)(36)(37)(38)(39)(40)(41)43) are unique numeric variables, but continuous features (1,5,6,10,11,13,16,17,18,19) can take any real value within a range. The dataset's 'attack' label has 40 labels, categorizing attacks as revised, U2R, DoS, R2L, and probing.…”

“…The system consistently monitors network data transmission, identifying and alerting administrators of any abnormal behavior that may indicate a security breach [7,8]. The IDS operate as a software application that conducts scans across the network or system to detect malevolent activity or violations of regulations [9,10]. Any identified malicious behavior is promptly reported to the system administrator or consolidated centrally using a Security Information and Event Management (SIEM) system.…”

An efficient intrusion detection model based on convolutional spiking neural network

“…Results from their experiments indicate that their models are accurate and recall well, outperforming similar models in the literature. A CNN intrusion detection model based on attention is proposed in the study 17 . The combination of the image generation methods presented in this paper results in a processing flow that is efficient and accurate.…”

“…Each feature is represented as a binary matrix in the form of a 4 × 4 matrix. In total, 64 features are selected (arranged 8 × 8), which will be represented by a 32 × 32 matrix 17 .…”