Network intrusion detection via tri-broad learning system based on spatial-temporal granularity

Abstract

Network intrusion detection system plays a crucial role in protecting the integrity and availability of sensitive assets. Network traffic data contains a large amount of time, space, and statistical information. Existing research lacks the utilization of spatial-temporal multi-granularity data features and the mutual support among different data features, thus making it difficult to specifically and accurately identify anomalies. Taking into account the distinctions among different granularities, we propose a framework called Tri-Broad Learning System (TBLS), which can learn and integrate the three granular features. In order to accurately explore the spatial-temporal connotation of the traffic information, a feature dataset containing three granularities is constructed according to the characteristics of time, space, and data content. In this way, we use broad learning basic units to extract abstract features of different granularities, and then express these features in different feature spaces to enhance them separately. We use the "He" instead of the original initialization method in BLS to initialize the weights of feature nodes and enhancement nodes to achieve better detection accuracy. We exhibit the merits of our proposed model on the UNSW-NB15, CIC-IDS-2017, and mixed traffic datasets. Experimental JOURNAL OF SUPERCOMPUTING results show that TBLS outperforms the typical BLS in terms of various evaluation metrics and time consumption. Compared with other machine learning methods, TBLS achieves better performance metrics.

Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection

“…From this table are also derived three merit factors that contribute to the analysis of a classifier's performance: the precision (P) (6) merit factor takes into account the number of correct attack identifications concerning the total number of detections. It is obtained with the following formula: P = TP/TP + FP (6) The recall (R) (7) factor of merit takes into account the number of correct attack identifications compared to the total number of attacks made: R = TP/TP + FN (7) Finally, the F1-score factor (F1) ( 8) is given by the harmonic average of precision and recall and measures the accuracy of the classification of events:…”

“…They might cause the loss of priceless sensitive data, such as hospital files, military records, etc. Furthermore, they can disable phone and computer Future Internet 2023, 15, 297 2 of 19 networks, making data unavailable or rendering systems unusable [5][6][7]. Banking and government networks are particularly vulnerable because of the tremendous value of the data they contain.…”