Introducing Deep Learning Self-Adaptive Misuse Network Intrusion Detection Systems

Abstract

The intrusion detection systems (IDSs) are essential elements when it comes to the protection of an ICT infrastructure. A misuse IDS is a stable method that can achieve high attack detection rates (ADR) while keeping false alarm rates under acceptable levels. However, the misuse IDSs suffer from the lack of agility, as they are unqualified to adapt to new and ''unknown'' environments. That is, such an IDS puts the security administrator into an intensive engineering task for keeping the IDS up-to-date every time it faces efficiency drops. Considering the extended size of modern networks and the complexity of big network traffic data, the problem exceeds the substantial limits of human managing capabilities. In this regard, we propose a novel methodology which combines the benefits of self-taught learning and MAPE-K frameworks to deliver a scalable, self-adaptive, and autonomous misuse IDS. Our methodology enables the misuse IDS to sustain high ADR, even if it is imposed on consecutive and drastic environmental changes. Through the utilization of deep-learning based methods, the IDS is able to grasp an attack's nature based on the generalized feature reconstructions stemming directly from the unknown environment and its unlabeled data. The experimental results reveal that our methodology can breathe new life into the IDS without the constant need for manually refreshing its training set. We evaluate our proposal under several classification metrics and demonstrate that the ADR of the IDS increases up to 73.37% in critical situations where a statically trained IDS is rendered totally ineffective.

An Explainable Machine Learning Framework for Intrusion Detection Systems

“…Meanwhile, Yin et al used LSTMs [22] as the deep learning approach for intrusion detection. Papamartzivanos et al used a self-taught learning method to deliver a self-adaptive IDS [42]. Furthermore, Yang et al proposed a new intrusion detection model that combined an improved conditional variational AutoEncoder (ICVAE) with a DNN [24] to enhance detection rates.…”

Ensemble and Deep-Learning Methods for Two-Class and Multi-Attack Anomaly Intrusion Detection: An Empirical Study

“…The processing layer, often referred to as the hidden layer, may contain one or more layers-a basic implementation of neural network is the Multilayer Perceptron (MLP) [18]. DL is an advancement on the MLP [19], but with more sophisticated and densely connected neurons that are capable of representing and extracting data in a more advanced form from data and mapping it into the output [20,21]. The neural network implementations that are used for DL include but not limited to Convolutional Neural Network, RNN and Long Short-Term Memory (LSTM).…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…It can be observed that the processing speed of CNN and RNN are 4.2 ms and 2.8 ms for a single sample. In [523], a DL based adaptive and scalable misuse IDS is proposed. The MAPE-K reference model and STL model are used to learn from reconstructed data and to create a self adaptive misuse IDS.…”