Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

Abstract

Network intrusion detection plays a very important role in protecting computer network security. The abnormal traffic detection and analysis by extracting the statistical features of flow is the main analysis method in the field of network intrusion detection. However, these features need to be designed and extracted manually, which often loses the original information of the flow and leads to poor detection efficiency. In this paper, we do not manually design the features of the flow but directly extract the raw data information of the flow for analysis. In addition, we first proposed a new network intrusion detection model named the deep hierarchical network, which integrates the improved LeNet-5 and LSTM neural network structures, while learning the spatial and temporal features of flow. By designing a reasonable network cascading method, we can train our proposed hierarchical network at the same time instead of training two networks separately. In this paper, we use the CICIDS2017 dataset and the CTU dataset. The number and types of flow in these two datasets are large, and the attack types are relatively new. The experimental results show that the performance of the proposed hierarchical network model is significantly better than other network intrusion detection models, which can achieve the best detection accuracy. Finally, we also present an analysis method for traffic features which has an important contribution to abnormal traffic detection and gives the actual meanings of these important features. INDEX TERMS Network intrusion detection, deep hierarchical network, raw feature, feature importance.

An Intrusion Detection System for Multi-class Classification Based on Deep Neural Networks

“…Similarly, in, [24] and, [25] the authors using random forest and LSTM respectively came up evaluating their models using the AUC metric reporting 0.96 and 0.87 values as an average of all classes used. In, [2], Zhang et al, using CNN and LSTM models report accuracy equal to 99.77%, precision equal to 99.94%, recall equal to 99.95%, and F1 Score equal to 99.94%, classifying only 10 classes (dropping the ones with the fewer instances in the dataset) and without reporting the use of cross validation or not.…”

“…Intrusion Detection System (IDS) is an efficient security reinforcement tool for the detection and the protection of cyber-attacks in any network or host. The IDSs' responsibility is to detect suspicious behaviors and act appropriately to protect the network from the onset of attacks and reduce functionally and financial losses, [2].…”

“…Thus, traffic classification is a core component in an Intrusion Detection System, which since analyze network packets, can determine whether the network behavior violates the systems security, by continuously monitoring the network. IDSs, in order to work properly and detect abnormal activities effectively, use divided traffic packets into network flows, according to source/ destination IP, source/ destination port, protocol, and timestamp, [7], [8]. A useful flow definition is mentioned bellow.…”

“…Zhang, et al, [2], presented a anomaly detection model based on neural network. They designed an IDS using LeNet-5 convolutional neural network and LSTM network for feature extraction.…”

Network Intrusion Detection Combined Hybrid Sampling With Deep Hierarchical Network

“…These studies prompt us to use deep neural networks to learn the hierarchical features of network traffic (that is, the spatial and temporal features) for classifying network traffic [26]. However, due to the serious imbalance between the network intrusion traffic, the proportion of various traffic data varies greatly, and most detection methods aim to reduce the overall average rate of false positives, which will lead to the increase of the rate of false positives in minority samples.…”