Network anomaly detection using channel boosted and residual learning based deep convolutional neural network

Chouhan, Naveed; Khan, Asifullah; Khan, Haroon-ur-Rasheed

doi:10.1016/j.asoc.2019.105612

Cited by 89 publications

(42 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e authors also used an important number of hidden nodes (80) considering the modest performance of the model. Finally, the highest evaluation metrics were found in [13] and in this research. e main difference is simplicity: in our approach the results are obtained using weak feedforward neural learners with a small number of parameters, while their approach is based on conventional neural network that involves channel boosting, autoencoders, and stacked autoencoders and many intermediate functions.…”

mentioning

confidence: 49%

“…e model achieved 81.29% accuracy using 80 hidden nodes in binary classification. An effective network intrusion detection system, using an architecture called Channel Boosted and Residual learning based deep Convolutional Neural Network (CBR-CNN), is developed using one-class classification in [13]. e model uses a Reconstructed Feature Space that reconstructs a feature space using only normal traffic.…”

Section: Related Workmentioning

confidence: 99%

“…Model Dataset Accuracy (%) El Hajji et al [9] NN with best cost and training function NSL-KDD 81.8 Javaid et al [10] Sparse autoencoder with SMR NSL-KDD 78.06 Gurung et al [11] Sparse autoencoder with LR NSL-KDD 87.2 Yin et al [12] RNN based IDS NSL-KDD 81.29 Chouhan et al [13] CBR-CNN based IDS NSL-KDD 89.41 Maddikunta et al [14] DNN with PCA-GWO Kaggle dataset 99.9 Suarez-Tangil et al [15] NN and GP --Ussath et al [16] RNN and NN -89 Chiba et al [17] NN KDD 99.62 Bhattacharya et al [18] PCA-firefly based XGBoost Kaggle dataset 99.9 Gadekallu et al [19] Naive Bayes Kaggle and CERT-In repositories 99.9…”

Section: Referencementioning

confidence: 99%

See 2 more Smart Citations

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Moukafih

Orhanou

Hajji

2020

Security and Communication Networks

View full text Add to dashboard Cite

Integrating intelligence into intrusion detection tools has received much attention in the last years. The goal is to improve the detection capability within SIEM and IDS systems in order to cope with the increasing number of attacks using sophisticated and complex methods to infiltrate systems. Current SIEM and IDS systems have many processes involved, which work together to collect, analyze, detect, and send notification of failures in real time. Event normalization, for example, requires significant processing power to handle network events. So, adding heavy deep learning models will invoke additional resources for the SIEM or IDS tool. This paper presents a majority system based on reliability approach that combines simple feedforward neural networks, as weak learners, and produces high detection capability with low computation resources. The experimental results show that the model is very suitable for modeling a classification model with high accuracy and that its performance is superior to that of complex resource-intensive deep learning models.

show abstract

mentioning

confidence: 49%

Section: Related Workmentioning

confidence: 99%

Section: Referencementioning

confidence: 99%

See 1 more Smart Citation

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Moukafih

Orhanou

Hajji

2020

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Otoum et al [13] devised DL for an IDS available on wireless sensor networks (WSNs), and also compared the Boltzmann machine-based clustered IDS (RBC-IDS) and adaptive machine learning-based IDS: the adaptively supervised and clustered hybrid IDS (ASCH-IDS). Chouhan et al [14] proposed a Channel Boosted and Residual learning-based deep Convolutional Neural Network (CBR-CNN) architecture for the detection of network intrusions. This study used Stacked Auto-encoders (SAE) and unsupervised training, and the performance of the proposed CBR-CNN technique is evaluated with an NSL-KDD dataset.…”

Section: A Related Workmentioning

confidence: 99%

AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection

Park²,

2020

View full text Add to dashboard Cite

Deep Learning has been widely applied to problems in detecting various network attacks. However, no cases on network security have shown applications of various deep learning algorithms in real-time services beyond experimental conditions. Moreover, owing to the integration of high-performance computing, it is necessary to apply systems that can handle large-scale traffic. Given the rapid evolution of web-attacks, we implemented and applied our Artificial Intelligence-based Intrusion Detection System (AI-IDS). We propose an optimal convolutional neural network and long short-term memory network (CNN-LSTM) model, normalized UTF-8 character encoding for Spatial Feature Learning (SFL) to adequately extract the characteristics of real-time HTTP traffic without encryption, calculating entropy, and compression. We demonstrated its excellence through repeated experiments on two public datasets (CSIC-2010, CICIDS2017) and fixed real-time data. By training payloads that analyzed true or false positives with a labeling tool, AI-IDS distinguishes sophisticated attacks, such as unknown patterns, encoded or obfuscated attacks from benign traffic. It is a flexible and scalable system that is implemented based on Docker images, separating user-defined functions by independent images. It also helps to write and improve Snort rules for signature-based IDS based on newly identified patterns. As the model calculates the malicious probability by continuous training, it could accurately analyze unknown web-attacks.

show abstract

“…Gong et al [28] proposed model uncertainty to evaluate predictions made by DeepLearning-based Web attack models. There are also many algorithm models that use deep learning to detect Web attacks: Long Short-Term (LSTM) [29,30], Specially Designed Convolution Neural Network (SDCNN) [31], Character-Level Convolution Neural Networks (CLCNN) [32], Channel Boosted and Residual learning-based CNN (CBR-CNN) structure [33]. It can be continuously optimized during training and testing to extract more accurate feature values, but training complex network nodes or layers is slow.…”

Section: B Detection Algorithmsmentioning

confidence: 99%

The Weighted Word2vec Paragraph Vectors for Anomaly Detection Over HTTP Traffic

Zhang

Wei

2020

IEEE Access

View full text Add to dashboard Cite

Anomaly detection over HTTP traffic has attracted much attention in recent years, which plays a vital role in many domains. This paper proposes an efficient machine learning approach to detect anomalous HTTP traffic that addresses the problems of existing methods, such as data redundancy and high training complexity. This algorithm draws on natural language processing (NLP) technology, uses the Word2vec algorithm to deal with the semantic gap, and implements Term Frequency-Inverse Document Frequency (TF-IDF) weighted mapping of HTTP traffic to construct a low-dimensional paragraph vector representation to reduce training complexity. Then we employs boosting algorithm Light Gradient Boosting Machine (LightGBM) and Categorical Boosting (CatBoost) to build an efficient and accurate anomaly detection model. The proposed method is tested on some artificial data sets, such as HTTP DATASET CSIC 2010, UNSW-NB15, and Malicious-URLs. Experimental results reveal that both the boosting algorithms have high detection accuracy, high true positive rate, and low false positive rate. Compared with other anomaly detection methods, the proposed algorithms require relatively short running time and low CPU memory consumption.

show abstract

Network anomaly detection using channel boosted and residual learning based deep convolutional neural network

Cited by 89 publications

References 18 publications

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

Neural Network-Based Voting System with High Capacity and Low Computation for Intrusion Detection in SIEM/IDS Systems

AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection

The Weighted Word2vec Paragraph Vectors for Anomaly Detection Over HTTP Traffic

Contact Info

Product

Resources

About