Cyber Intrusion Detection by Using Deep Neural Networks with Attack-sharing Loss

Abstract

Cyber attacks pose crucial threats to computer system security, and put digital treasuries at excessive risks. This leads to an urgent call for an effective intrusion detection system that can identify the intrusion attacks with high accuracy. It is challenging to classify the intrusion events due to the wide variety of attacks. Furthermore, in a normal network environment, a majority of the connections are initiated by benign behaviors. The class imbalance issue in intrusion detection forces the classifier to be biased toward the majority/benign class, thus leave many attack incidents undetected. Spurred by the success of deep neural networks in computer vision and natural language processing, in this paper, we design a new system named DeepIDEA that takes full advantage of deep learning to enable intrusion detection and classification. To achieve high detection accuracy on imbalanced data, we design a novel attack-sharing loss function that can effectively move the decision boundary towards the attack classes and eliminates the bias towards the majority/benign class. By using this loss function, DeepIDEA respects the fact that the intrusion mis-classification should receive higher penalty than the attack mis-classification. Extensive experimental results on three benchmark datasets demonstrate the high detection accuracy of DeepIDEA. In particular, compared with eight state-of-the-art approaches, DeepIDEA always provides the best class-balanced accuracy.

Low Complexity Shallow Neural Network With Improved False Negative Rate for Cyber Intrusion Detection Systems

“…Table II shows the recall and precision values for the individual classes. The first row contains the results for a neural network consisting of 10 layers with 100 neurons each published in [15], the second row shows the values obtained by using the attack-sharing loss for the training of our proposed single layer neural network with just 110 neurons, but with a much longer training of 133 epochs compared to the 10 epochs reported in [15]. The last row of Table II shows the results of the same architecture but trained with our improved attack-sharing loss function.…”

“…Table III shows the F1-scores for each class. The first row contains the F1-scores calculated from results reported in [15]. The other two rows show our The two confusion matrices in Figure 1 give a detailed characterization of the performance obtained with the two loss functions on the same single hidden layer architecture.…”

“…Guo Haixiang et al [6] mention in their article that the difficulty to acquire sufficient knowledge about the cost in relation to the class imbalance greatly inhibits the widespread use of cost-sensitive learning. Recent developments in machine learning, however, have shown that it is possible to achieve cost-sensitive learning without the need for specially crafted cost matrices by using loss functions such as the attack-sharing loss proposed by Dong et al [15].…”

“…A full description of the data set can be found in [10]. Since the provided data was heavily skewed towards the benign class, we decided to combine attacks of a common family and excluded those with insufficient data points as it was proposed by [15]. The resulting simplified sample set provided in Table I remains obviously quite imbalanced.…”

“…The resulting simplified sample set provided in Table I remains obviously quite imbalanced. To address this problem, Dong et al [15] proposed an adaptation of the cross-entropy loss function, which they called attack-sharing loss that can be quantified with equation 1.…”