Attack classification of an intrusion detection system using deep learning and hyperparameter optimization

Kunang, Yesi Novaria; Nurmaini, Siti; Stiawan, Deris; Suprapto, Bhakti Yudho

doi:10.1016/j.jisa.2021.102804

Cited by 101 publications

(47 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compared to signaturebased IDSs, machine learning techniques can detect large families of attack variants regardless of their complexity. Typical machine learning techniques for classification are used to train models of malicious behaviour based on existing labelled datasets of system activity [1,18]. Classification can be binary (i.e.…”

Section: Introductionmentioning

confidence: 99%

An Intrusion Detection System Based on Deep Belief Networks

Belarbi

Khan

Carnelli

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The rapid growth of connected devices has led to the proliferation of novel cyber-security threats known as zero-day attacks. Traditional behaviour-based Intrusion Detection Systems (IDSs) rely on Deep Neural Networks (DNNs) to detect these attacks. The quality of the dataset used to train the DNNs plays a critical role in the detection performance, with underrepresented samples causing poor performances. In this paper, we develop and evaluate the performance of Deep Belief Networks (DBNs) on detecting cyber-attacks within a network of connected devices. The CICIDS2017 dataset was used to train and evaluate the performance of our proposed DBN approach. Several class balancing techniques were applied and evaluated. Lastly, we compare our approach against a conventional Multi-Layer Perceptron (MLP) model and the existing state-of-the-art. Our proposed DBN approach shows competitive and promising results, with significant performance improvement on the detection of attacks underrepresented in the training dataset.

show abstract

Section: Introductionmentioning

confidence: 99%

An Intrusion Detection System Based on Deep Belief Networks

Belarbi

Khan

Carnelli

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…In [ 21 ], researchers from Stratosphere Laboratory produced a dataset to solely facilitate the detection of IoT-based botnets. Even though there are some alternatives available, it is not close to enough [ 22 ].…”

Section: Introductionmentioning

confidence: 99%

“…The performance of IDS often varies when different sets of features of network data are used. Publicly available datasets do not have a standardized set of features [ 22 ].…”

Section: Introductionmentioning

confidence: 99%

“…Detecting anomalies from benign traffic or identifying various attacks from typical network datasets using only traditional ML approaches have seen great success [ 24 , 25 , 26 ]. However, traditional ML approaches struggle when dealing with a large volume of IoT data [ 22 , 27 , 28 ].…”

Section: Introductionmentioning

confidence: 99%

“…However, given the limited amount of computational power on edge devices, retraining the models with new inputs proves challenging. DL does not perform well with limited data, even with an optimized parameter set [ 22 ]. Optimally, lightweight IDS [ 32 ], which is a powerful yet small and flexible form of IDS, is a preferable choice for edge and fog networks.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Liu

Thapa

Shaver

et al. 2021

Sensors

View full text Add to dashboard Cite

As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

show abstract

A feed forward deep neural network model using feature selection for cloud intrusion detection system

Sharma,

Singh

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryThe rapid advancement and growth of technology have rendered cloud computing services indispensable to our activities. Threats and intrusions have since multiplied exponentially across a range of industries. In such a scenario, the intrusion detection system, or simply the IDS, is deployed on the network to monitor and detect any attacks. The paper proposes a feed‐forward deep neural network (FFDNN) method based on deep learning methodology using a filter‐based feature selection model. The feature selection strategy aims to determine and select the most highly relevant subset of attributes from the feature importance score for training the deep learning model. Three benchmark data sets were used to assess the experiment: CIC‐IDS 2017, UNSW‐NB15, and NSL‐KDD. In order to justify the proposed technique, a comparison was done using other learning algorithms ranging from classical machine learning to ensemble learning methods that can detect various attacks. The experiments showed that the FFDNN model with reduced feature subsets gave the highest accuracy of 99.53% and 94.45% in the NSL‐KDD and UNSW‐NB15 data sets, while the ensemble‐based XGBoost model performed better in the CIC‐IDS 2017 data set. In addition, the results show that the overall accuracy, recall, and F1 score of the deep learning algorithm are generally better for all the data sets.

show abstract

Attack classification of an intrusion detection system using deep learning and hyperparameter optimization

Cited by 101 publications

References 34 publications

An Intrusion Detection System Based on Deep Belief Networks

An Intrusion Detection System Based on Deep Belief Networks

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

A feed forward deep neural network model using feature selection for cloud intrusion detection system

Contact Info

Product

Resources

About