LA-GRU: Building Combined Intrusion Detection Model Based on Imbalanced Learning and Gated Recurrent Unit Neural Network

Abstract

The intrusion detection models (IDMs) based on machine learning play a vital role in the security protection of the network environment, and, by learning the characteristics of the network traffic, these IDMs can divide the network traffic into normal behavior or attack behavior automatically. However, existing IDMs cannot solve the imbalance of traffic distribution, while ignoring the temporal relationship within traffic, which result in the reduction of the detection performance of the IDM and increase the false alarm rate, especially for low-frequency attacks. So, in this paper, we propose a new combined IDM called LA-GRU based on a novel imbalanced learning method and gated recurrent unit (GRU) neural network. In the proposed model, a modified local adaptive synthetic minority oversampling technique (LA-SMOTE) algorithm is provided to handle imbalanced traffic, and then the GRU neural network based on deep learning theory is used to implement the anomaly detection of traffic. The experimental results evaluated on the NSL-KDD dataset confirm that, compared with the existing state-of-the-art IDMs, the proposed model not only obtains excellent overall detection performance with a low false alarm rate but also more effectively solves the learning problem of imbalanced traffic distribution.

Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning

“…Experiments on the UCI dataset show that the proposed combination technique can improve class imbalance problems. Yan proposed an improved local adaptive composite minority sampling algorithm(LA-SMOTE) to deal with the network traffic imbalance problem and then based on the deep learning GRU neural network to detect the network traffic anomaly [21]. Abdulhammed et al [22] deal with the imbalanced dataset CIDDS-001 using data Upsampling and Downsampling methods, and by Deep Neural Networks, Random Forest, Voting, Variational Autoencoder, and Stacking Machine Learning classifiers to evaluate datasets.…”

Intrusion Detection for Wireless Edge Networks Based on Federated Learning

“…Yang et al [11] proposed a wireless network intrusion detection method based on an improved convolutional neural network (ICNN), and the KDD CUP99 data set was used to verify the algorithm's effectiveness. In [12], the author proposed an intrusion detection model called LA-GRU based on a novel imbalanced learning method and gated recurrent unit (GRU) neural network. LA-GRU not only obtained excellent overall detection performance with a low false alarm rate, but also effectively solved the learning problem of imbalanced traffic distribution.…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…The proposed LSTM model is compared with other traditional ML classifiers. In [488], a GRU based IDS is proposed where a novel technique called local adaptive SMOTE is used to deal with imbalanced network traffic data. The GRU model extracts the temporal features from the data and learns to classify it.…”