TR-IDS: Anomaly-Based Intrusion Detection through Text-Convolutional Neural Network and Random Forest

Min, Erxue; Long, Jun; Liu, Qiang; Cui, Jianjing; Chen, Wei

doi:10.1155/2018/4943509

Cited by 126 publications

(59 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Approaches based on flow-level statistics have also been proposed in [34]- [39], among many others. In particular, [36]- [39] use flow-level statistics to feed CNNs and other DL models, as discussed in Sec. II-C. To overcome the limitations of statistical approaches to DDoS detection, machine learning techniques have been explored.…”

Section: A Statistical Approaches To Ddos Detectionmentioning

confidence: 99%

“…Some CNN-based works [36]- [39], as identified in Sec. II-A, use flow-level statistics (total bytes, flow duration, total number of flags, etc.)…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…as input to the proposed DL-based architectures. In addition, [36] and [37] combine the statistical features with packet payloads to train the proposed IDSs.…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…In Sec. V, we compare our proposed solution, LUCID, with the state-of-the-art, specifically [4], [35], [36], [38], [47] and demonstrate the contributions of LUCID.…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…This indicates a performance benefit when using the LUCID preprocessing mechanism. TR-IDS [36] is an IDS which adopts a text-CNN [9] to extract features from the payload of the network traffic. These features, along with a combination of 25 packet and flowlevel attributes, are used for traffic classification by means of a Random Forest algorithm.…”

Section: B State-of-the-art Comparisonmentioning

confidence: 99%

See 4 more Smart Citations

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Doriguzzi-Corin

Millar

Scott-Hayward

et al. 2020

IEEE Trans. Netw. Serv. Manage.

197

103

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks are one of the most harmful threats in today's Internet, disrupting the availability of essential services. The challenge of DDoS detection is the combination of attack approaches coupled with the volume of live traffic to be analysed. In this paper, we present a practical, lightweight deep learning DDoS detection system called LUCID, which exploits the properties of Convolutional Neural Networks (CNNs) to classify traffic flows as either malicious or benign. We make four main contributions; (1) an innovative application of a CNN to detect DDoS traffic with low processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce traffic observations for online attack detection, (3) an activation analysis to explain LUCID's DDoS classification, and (4) an empirical validation of the solution on a resource-constrained hardware platform. Using the latest datasets, LUCID matches existing stateof-the-art detection accuracy whilst presenting a 40x reduction in processing time, as compared to the state-of-the-art. With our evaluation results, we prove that the proposed approach is suitable for effective DDoS detection in resource-constrained operational environments.

show abstract

Section: A Statistical Approaches To Ddos Detectionmentioning

confidence: 99%

“…Some CNN-based works [36]- [39], as identified in Sec. II-A, use flow-level statistics (total bytes, flow duration, total number of flags, etc.)…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…as input to the proposed DL-based architectures. In addition, [36] and [37] combine the statistical features with packet payloads to train the proposed IDSs.…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

“…In Sec. V, we compare our proposed solution, LUCID, with the state-of-the-art, specifically [4], [35], [36], [38], [47] and demonstrate the contributions of LUCID.…”

Section: Deep Learning For Ddos Detectionmentioning

confidence: 99%

Section: B State-of-the-art Comparisonmentioning

confidence: 99%

See 3 more Smart Citations

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Doriguzzi-Corin

Millar

Scott-Hayward

et al. 2020

IEEE Trans. Netw. Serv. Manage.

197

103

View full text Add to dashboard Cite

show abstract

Design and analysis of efficient neural intrusion detection for wireless sensor networks

Batiha

Krömer

2020

Concurrency and Computation

View full text Add to dashboard Cite

Wireless sensor networks (WSNs) are important building blocks of the communication infrastructure in smart cities, intelligent transportation systems, Industry, Energy, and Agriculture 4.0, the Internet of Things, and other areas quickly adopting the concepts of fog and edge computing. Their cybernetic security is a major issue and efficient methods to improve their safety and reliability are required. Intrusion detection systems (IDSs) are complex systems that discover cybernetic attacks, detect malicious network traffic, and, in general, protect computer systems. Artificial neural networks are used by a variety of advanced intrusion detection systems with outstanding results.Their successful use in the specific conditions of WSNs requires efficient learning, adaptation, and inference. In this work, the acceleration of a neural intrusion detection model, developed specifically for wireless sensor networks, is proposed and studied, especially from the learning and classification accuracy and energy consumption points of view.

show abstract

Denial of service detection using dynamic time warping

et al. 2021

View full text Add to dashboard Cite

Summary With the rapid growth of security threats in computer networks, the need for developing efficient security‐warning systems is substantially increasing. Distributed denial‐of‐service (DDoS) and DoS attacks are still among the most effective and dreadful attacks that require robust detection. In this work, we propose a new method to detect TCP DoS/DDoS attacks. Since analyzing network traffic is a promising approach, our proposed method utilizes network traffic by decomposing the TCP traffic into control and data planes and exploiting the dynamic time warping (DTW) algorithm for aligning these two planes with respect to the minimum Euclidean distance. By demonstrating that the distance between the control and data planes is considerably small for benign traffic, we exploit this characteristic for detecting attacks as outliers. An adaptive thresholding scheme is implemented by adjusting the value of the threshold in accordance with the local statistics of the median absolute deviation (MAD) of the distances between the two planes. We demonstrate the efficacy of the proposed method for detecting DoS/DDoS attacks by analyzing traffic data obtained from publicly available datasets.

show abstract

TR-IDS: Anomaly-Based Intrusion Detection through Text-Convolutional Neural Network and Random Forest

Cited by 126 publications

References 28 publications

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

Design and analysis of efficient neural intrusion detection for wireless sensor networks

Denial of service detection using dynamic time warping

Contact Info

Product

Resources

About