Benchmarking Deep Learning Methods for Behaviour-Based Network Intrusion Detection

Abstract

Network security encloses a wide set of technologies dealing with intrusions detection. Despite the massive adoption of signature-based network intrusion detection systems (IDSs), they fail in detecting zero-day attacks and previously unseen vulnerabilities exploits. Behaviour-based network IDSs have been seen as a way to overcome signature-based IDS flaws, namely through the implementation of machine-learning-based methods, to tolerate new forms of normal network behaviour, and to identify yet unknown malicious activities. A wide set of machine learning methods has been applied to implement behaviour-based IDSs with promising results on detecting new forms of intrusions and attacks. Innovative machine learning techniques have emerged, namely deep-learning-based techniques, to process unstructured data, speed up the classification process, and improve the overall performance obtained by behaviour-based network intrusion detection systems. The use of realistic datasets of normal and malicious networking activities is crucial to benchmark machine learning models, as they should represent real-world networking scenarios and be based on realistic computers network activity. This paper aims to evaluate CSE-CIC-IDS2018 dataset and benchmark a set of deep-learning-based methods, namely convolutional neural networks (CNN) and long short-term memory (LSTM). Autoencoder and principal component analysis (PCA) methods were also applied to evaluate features reduction in the original dataset and its implications in the overall detection performance. The results revealed the appropriateness of using the CSE-CIC-IDS2018 dataset to benchmark supervised deep learning models. It was also possible to evaluate the robustness of using CNN and LSTM methods to detect unseen normal activity and variations of previously trained attacks. The results reveal that feature reduction methods decreased the processing time without loss of accuracy in the overall detection performance.

Attack vs Benign Network Intrusion Traffic Classification

“…This is due to the high similarity of attack and benign patterns for this particular data file. In fact, even in this extreme case the results obtained with the nearest neighbor algorithm are comparable to the results reported using deep learning [20] (Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM)), as shown in Table 3. The CNN and LSTM results show a better accuracy and precision, however the nearest neighbor method provides a much better F-measure and recall, showing that it deals better with such an unbalaced data set.…”

“…for such a simple method. However, the results obtained with the other more complex methods, including deep learning neural networks also show a bad performance in the case of 03-01-2018.csv [1]- [20], with comparable values. This is due to the high similarity of attack and benign patterns for this particular data file.…”

“…The anomaly-based IDS uses machine learning techniques to detect anomalous traffic. This type of IDS usually has a higher false-positive rate, and the inconvenience of training a model, which in turn requires a good training data set [1]- [20].…”

“…Here we discuss the machine learning approach to building an anomaly-based IDS using the CSE-CIC-IDS2018 dataset [21]. Since its publication, the CSE-CIC-IDS2018 dataset has been frequently used to train IDS based on machine learning methods, and it has been adopted as a benchmark for anomaly-based IDS implementations [1]- [20] 1 . Interestingly, most of these implementations are based on complex solutions like deep learning neural networks, random forest and gradient boosting classifiers, or hidden Markov models.…”

A tree growth based forward feature selection algorithm for intrusion detection system on convolutional neural network

“…As a result, the present focus of this thesis is to create a network-based IDS that can identify attacks in a big, high-speed, high-volume venture network. Research by Antunes et al [37] offer a scenario in which an attacker attacks a specific system without authorization while avoiding harming other networks with the necessity to look for, and send hidden and sensitive data. Experts can carry out such an assault to conceal the entire attack and avoid detection.…”