BAT: Deep Learning Methods on Network Intrusion Detection Using NSL-KDD Dataset

Abstract

Intrusion detection can identify unknown attacks from network traffics and has been an effective means of network security. Nowadays, existing methods for network anomaly detection are usually based on traditional machine learning models, such as KNN, SVM, etc. Although these methods can obtain some outstanding features, they get a relatively low accuracy and rely heavily on manual design of traffic features, which has been obsolete in the age of big data. To solve the problems of low accuracy and feature engineering in intrusion detection, a traffic anomaly detection model BAT is proposed. The BAT model combines BLSTM (Bidirectional Long Short-term memory) and attention mechanism. Attention mechanism is used to screen the network flow vector composed of packet vectors generated by the BLSTM model, which can obtain the key features for network traffic classification. In addition, we adopt multiple convolutional layers to capture the local features of traffic data. As multiple convolutional layers are used to process data samples, we refer BAT model as BAT-MC. The softmax classifier is used for network traffic classification. The proposed end-to-end model does not use any feature engineering skills and can automatically learn the key features of the hierarchy. It can well describe the network traffic behavior and improve the ability of anomaly detection effectively. We test our model on a public benchmark dataset, and the experimental results demonstrate our model has better performance than other comparison methods.

Applications of Machine Learning in Networking: A Survey of Current Issues and Future Challenges

“…To address the misclassification issues in IDS, Su et al [96] proposed BAT-MC, a novel methodology for IDS that integrates the Bat and DL algorithms. The Bat algorithm combines the bidirectional long-short-term memory (BLSTM) with the attention mechanism.…”

A Novel Wireless Network Intrusion Detection Method Based on Adaptive Synthetic Sampling and an Improved Convolutional Neural Network

“…An LSTM classifier with a gradient descent optimizer is used in IDS [30], which can effectively mine the association between features from the perspective of time. Su et al [31] combined an attention mechanism and BLSTM (bidirectional long short-term memory) to propose a network anomaly detection model BAT, which extracts coarse-grained features by connecting forward LSTM and backward LSTM. The BAT model uses an attention mechanism to filter the network flow vectors generated by the BLSTM model to obtain the key characteristics of network traffic classification.…”

Mitigating Malicious Insider Attacks in the Internet of Things using Supervised Machine Learning Techniques

“…The various attacks included in NSL-KDD dataset include: DoS (Denial of Services) attack, User-to-Root attack, Remote-to-local attack and Probes. In the literature, this dataset has been widely used to assess the performance of anomaly-based attack detection systems for IoT network [6,7,8].…”

“…dataset and data pre-processing. NSL-KDD is the latest version of KDD99 dataset and has been widely used by researchers to evaluate the performance of the attack detection system in IoT [6,7,8]. In NSL-KDD dataset, the training data is available in "KDDTrain+" file, consisting of 125973 data entries, out of which 67343 entries represent non-malicious and 58630 entries represent malicious.…”