STIDM: A Spatial and Temporal Aware Intrusion Detection Model

Han, Xueying; Yin, Rongchao; Lü, Zhigang; Jiang, Bo; Liu, Yuling; Song, Lei; Wang, Chonghua; Li, Ning

doi:10.1109/trustcom50675.2020.00058

Cited by 18 publications

(13 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…STIDM was trained on truncated flows of multiple packets created by grouping on the tuple (SourceIP, SourcePort, DestinationIP, DestinationPort, Protocol). We observe that it is difficult to attribute the outstanding performance of STIDM to the CNN and/or the LSTM from the results shown in [12]. Furthermore, STIDM works on truncated sequences of packets, which makes determining the existence of temporal patterns in NetFlows unfeasible.…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 95%

“…The authors of [12] proposed a Spatial and Temporal Aware Intrusion Detection Model (STIDM) composed of LeNet-5 3 and a modified version of the LSTM. LeNet-5 was used to extract spatial features, while the modified LSTM was used to extract temporal patterns by taking into account the time intervals between packet exchanges.…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%

“…The approach in [35] is similar to [12], as they use the same STIDM structure to extract spatial features and temporal patterns, but the LSTM architecture is different. In this work, the overall model was used to analyze sequences of packets composed of only the first 160 bytes of every packet; then, the packets are aggregated by following the same five-tuple of STIDM, but only the first 10 packets in each sequence are considered.…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%

“…In this work, the overall model was used to analyze sequences of packets composed of only the first 160 bytes of every packet; then, the packets are aggregated by following the same five-tuple of STIDM, but only the first 10 packets in each sequence are considered. Similarly to [12], from [35] it is difficult to conclude anything about the existence temporal patterns among NetFlows and about the true benefits brought by the LSTM, since the results of the tested models (CNN, LSTM and CNN+LSTM) showed comparable performance.…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%

“…A different proposal for a end-to-end pipeline is in [31]. Here, instead of chaining a CNN with a LSTM (as in [12]), the authors first create a block composed by these two techniques, and then stack many of these blocks obtaining higher abstraction levels. Although the final performance of such architecture achieves excellent results, the method for processing the input data is poorly described, and no information is provided as to how the temporal domain is used.…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%

See 4 more Smart Citations

On the Evaluation of Sequential Machine Learning for Network Intrusion Detection

Andrea

Yang

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Recent advances in deep learning renewed the research interests in machine learning for Network Intrusion Detection Systems (NIDS). Specifically, attention has been given to sequential learning models, due to their ability to extract the temporal characteristics of Network traffic Flows (NetFlows), and use them for NIDS tasks. However, the applications of these sequential models often consist of transferring and adapting methodologies directly from other fields, without an in-depth investigation on how to leverage the specific circumstances of cybersecurity scenarios; moreover, there is a lack of comprehensive studies on sequential models that rely on NetFlow data, which presents significant advantages over traditional full packet captures. We tackle this problem in this paper. We propose a detailed methodology to extract temporal sequences of NetFlows that denote patterns of malicious activities. Then, we apply this methodology to compare the efficacy of sequential learning models against traditional static learning models. In particular, we perform a fair comparison of a 'sequential' Long Short-Term Memory (LSTM) against a 'static' Feedforward Neural Networks (FNN) in distinct environments represented by two well-known datasets for NIDS: the CICIDS2017 and the CTU13. Our results highlight that LSTM achieves comparable performance to FNN in the CICIDS2017 with over 99.5% F1-score; while obtaining superior performance in the CTU13, with 95.7% F1-score against 91.5%. This paper thus paves the way to future applications of sequential learning models for NIDS. CCS CONCEPTS• Security and privacy → Intrusion detection systems; Network security; • Computing methodologies → Temporal reasoning.

show abstract

Section: Automatic Extraction Of Featuresmentioning

confidence: 95%

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%