DLMHS: Flow‐based intrusion detection system using deep learning neural network and meta‐heuristic scale

Abstract

Summary The technological growth of the internet gained applications in various areas of human life like banking, public networking, online transactions, and electronic trade. The exponential growth of these services leads to increase of network traffic, and results increase in the number of possible network attacks. The researchers proposed various methodologies to address these from decades. It is evident from the literature that machine learning techniques, ANN methods, and Meta‐Heuristic approaches have gained significant reputation in handling security attacks and these methods depend on features of requests for extracting the knowledge. It is observed that the exponential growth in the volume of transactions in network traffic contains diversified behavior and exhibits deviation in feature values. Hence, it is required to consider the associability of transactions and its feature values. In this paper, a unique set of flow level features is defined to extract the knowledge from the traffic. The diversified behavior of the traffic is addressed with ensemble classifiers with distribution similarity and drift detection. The proposed model derives a threshold value using feature impact scale for the classifiers defined in the ensemble and analyzes the flow characteristics based on the threshold. The Deep Learning Neural Network (DLNN) is used for attack detection at flow level to validate the traffic as normal or attack. The experimental study is carried out with NSL‐KDD benchmark datasets to analyze the statistical parameters. Furthermore, the proposed model (DLMHS) is compared with existing models described in literature.