Deep Learning Approach on Network Intrusion Detection System using NSL-KDD Dataset

Abstract

The network infrastructure of any organization is always under constant threat to a variety of attacks; namely, break-ins, security breach or system misuse. The Network Intrusion Detection System (NIDS) employed in a network detects such penetration attacks and intrusions within a network. Known classes of attacks can be detected easily by performing pattern matching while the unknown attacks are harder to detect. An attempt has been made to design a system using a deep learning approach for intrusion detection that not only learns but also adjusts itself to the patterns not defined earlier. Sparse auto-encoder has been used for unsupervised feature learning. Logistic classifier is then utilized for classification on NSL-KDD dataset. The performance of the system has been measured with respect to accuracy, precision and recall and the results have been found to be very promising for future use and modifications.

A Survey on Different Machine Learning Algorithms and Weak Classifiers Based on KDD and NSL-KDD Datasets

“…This Deep learning methodology deals with several architectures like Deep Neural Networks, Convolution neural networks, Recurrent Neural Networks etc. Based on the depth or number of layers involved in the network generally tends to yield high accuracy when compared to less number of layers [12]. The working of these structures is as follows: Input layer takes the set of features and the output layer yields the specific set of features that are meant to be there in the targeted output.…”

Convolutional Neural Networks with LSTM for Intrusion Detection

“…Proceedings of 35th International Conference on Computers and Their Applications is of high importance to develop effective precautionary measures to safeguard users from attacks to which they are susceptible [2,35]. System designs which are used to detect malicious actions in a network are called Network Intrusion Detection Systems or NIDS [3,2]. The two main types are the Signature-based Network Intrusion Detection Systems or SNIDS and Anomaly Detection based Network Intrusion Detection Systems or ADNIDS.…”

“…SNIDS are aimed at detecting an unauthorized access or intrusion by matching patterns on the features for which it is trained. An ADNIDS type of system detects an anomaly when there is a deviation in the normal traffic pattern [2]. Since an ADNIDS is highly prone to false alarms, SNIDS are regarded as a preferred approach for Detecting Network Intrusions.…”

“…But, the drawback of machine learning approaches is that they rely on training and testing on datasets that may have features that differ from those encountered in new datasets to which they are applied. This motivates investigation into deep learning methods, which are promising because they are robust and efficient for problems with a large number of features [2].…”

“…Examples methods include Auto Encoder, deep belief network (DBN), deep neural network, and recurrent neural network (RNN) [14,15]. Previously many deep learning approaches are shown to be effective for NSL KDD datasets [2,4,5,6,9,11,12,13,14,15,17,18,19,22]. Stacked autoencoders were used in IEEE 802.11 network platforms to detect intrusion, which had an accuracy of 98.60% [16].…”