Towards Real-Time Deep Learning-Based Network Intrusion Detection on FPGA

Abstract

Traditionally, network intrusion detection systems identify attacks based on signatures, rules, events or anomaly detection. More and more research investigates the application of deep learning techniques for this purpose. Deep learning significantly increases detection performance, and can abolish the need for expert knowledge-intensive feature extraction. The use of deep learning for network intrusion detection also has a major disadvantage, however, as it is not deployed yet in real-time implementations. In this paper, we propose two approaches that facilitate the transition towards functional real-time implementations: (1) the use of flow buckets to collect raw traffic-based features, and (2) the acceleration of neural network architectures for intrusion detection using the Xilinx FINN toolchain for FPGAs. We obtain promising results that show our flow bucket approach does not deteriorate detection performance when compared to traditional approaches, and we lay a foundation to further build on with respect to accelerating deep learning algorithms for network intrusion detection on FPGA.

The Diversification and Enhancement of an IDS Scheme for the Cybersecurity Needs of Modern Supply Chains

“…Their experiments show that Pigasus can support up to 100 Gbps using an average of five cores and one FPGA and consuming 38× less power than a CPU-only approach. Le Jeune et al [42] implemented the first FPGA-based convolution neural network for NIDSs. Their results show that their implementation needs further optimization in order to manage real-time intrusion detection.…”