Network intrusion detection system: A systematic study of machine learning and deep learning approaches

Abstract

The rapid advances in the internet and communication fields have resulted in a huge increase in the network size and the corresponding data. As a result, many novel attacks are being generated and have posed challenges for network security to accurately detect intrusions. Furthermore, the presence of the intruders with the aim to launch various attacks within the network cannot be ignored. An intrusion detection system (IDS) is one such tool that prevents the network from possible intrusions by inspecting the network traffic, to ensure its confidentiality, integrity, and availability. Despite enormous efforts by the researchers, IDS still faces challenges in improving detection accuracy while reducing false alarm rates and in detecting novel intrusions. Recently, machine learning (ML) and deep learning (DL)‐based IDS systems are being deployed as potential solutions to detect intrusions across the network in an efficient manner. This article first clarifies the concept of IDS and then provides the taxonomy based on the notable ML and DL techniques adopted in designing network‐based IDS (NIDS) systems. A comprehensive review of the recent NIDS‐based articles is provided by discussing the strengths and limitations of the proposed solutions. Then, recent trends and advancements of ML and DL‐based NIDS are provided in terms of the proposed methodology, evaluation metrics, and dataset selection. Using the shortcomings of the proposed methods, we highlighted various research challenges and provided the future scope for the research in improving ML and DL‐based NIDS.

HCRNNIDS: Hybrid Convolutional Recurrent Neural Network-Based Network Intrusion Detection System

“…Deep learning (DL) is a subset of ML that consists of several hidden layers used to obtain the deep network's characteristics. Due to their deep structure and ability to learn the important features from the dataset on their own and produce an output, these techniques are more effective than ML [24].…”

An intrusion detection system using optimized deep neural network architecture

“…Ahamed et al 21 present an elaborate study of various Machine learning and Deep learning methodologies in the process of designing NIDS. This study article highlights the merits and challenges faced by various methodologies while detecting the attacks.…”

An End-to-End Framework for Machine Learning-Based Network Intrusion Detection System

“…The usage of old datasets for network security research is notorious [9], being challenging to tackle this issue, as described in [6]. The use of old datasets on NIDS research stills a concern as confirmed by [10]- [13], which reports the adoption of DARPA 1998, KDD-CUP '99, and NSL-KDD as the most-used ones, yet these datasets are around two decades old by now. An important factor in favor of reusing old datasets is applying Machine Learning (ML) algorithms to provide new approaches.…”

“…Content may change prior to final publication. [10] ML and DL [11] ML and DL [12] Datasets [13] ML and DL [14] Datasets [15] Methods [16] IoT AB-TRAP ML and Datasets and being a promising hybrid approach, the authors do not present the realization and performance evaluation of the solution to confirm their claims. It is also dependent on others datasets to continually evolve its solution.…”