Enhanced Network Anomaly Detection Based on Deep Neural Networks

By Sheraz Naseer, Yasir Saleem, Shehzad Khalid, Muhammad Khawar Bashir, Jihun Han, Muhammad Munwar Iqbal, Kijun Han. IEEE Access, 2018

424 citations recorded by the source corpus.

Due to the monumental growth of Internet applications in the last decade, the need for security of information network has increased manifolds. As a primary defense of network infrastructure, an intrusion detection system is expected to adapt to dynamically changing threat landscape. Many supervised and unsupervised techniques have been devised by researchers from the discipline of machine learning and data mining to achieve reliable detection of anomalies. Deep learning is an area of machine learning which applies neuron-like structure for learning tasks. Deep learning has profoundly changed the way we approach learning tasks by delivering monumental progress in different disciplines like speech processing, computer vision, and natural language processing to name a few. It is only relevant that this new technology must be investigated for information security applications. The aim of this paper is to investigate the suitability of deep learning approaches for anomaly-based intrusion detection system. For this research, we developed anomaly detection models based on different deep neural network structures, including convolutional neural networks, autoencoders, and recurrent neural networks. These deep models were trained on NSLKDD training data set and evaluated on both test data sets provided by NSLKDD, namely NSLKDDTest+ and NSLKDDTest21. All experiments in this paper are performed by authors on a GPU-based test bed. Conventional machine learning-based intrusion detection models were implemented using well-known classification techniques, including extreme learning machine, nearest neighbor, decision-tree, random-forest, support vector machine, naive-bays, and quadratic discriminant analysis. Both deep and conventional machine learning models were evaluated using well-known classification metrics, including receiver operating characteristics, area under curve, precision-recall curve, mean average precision and accuracy of classification. Experimental results of deep IDS models showed promising results for real-world application in anomaly detection systems.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/83996f9214d998ffb5ea8c2ea6104e96584f587b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

CNN-LSTM: Hybrid Deep Neural Network for Network Intrusion Detection System (2022, methodology): “The Max pooling 255 technique will reduce the sample size without affecting the 256 weights [14].”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, methodology): “…networks are evaluated with General network datasets [39], [48], [49], [53], and a large majority of recently proposed NIDS [39], [40], [41], [43], [46], [48], [49], [50] are evaluated with NSL-KDD and KDD Cup’99 only, which is over 20 years old and are not representative of network trafﬁc today.”
A Survey on Anomaly Detection for Technical Systems using LSTM Networks (2021, methodology): “In addition, [28] describes a denoising LSTM AE that aims to optimize prediction and detection accuracy by extracting underlying and uncorrupted relations in disturbed data.”
Network intrusion detection system: A systematic study of machine learning and deep learning approaches (2020, methodology): “Naseer et al 94 performed a comparative analysis of IDS based on different DL and ML algorithms and implemented on GPU-based testbed.”
Deep Learning for Anomaly Detection: A Survey (2019, methodology): “DataSet IDS Description Type References CTU-UNB NIDS CTU-UNB ucs [2017] dataset consists of various botnet traffics from CTU-13 dataset [20] and normal traffics from the UNB ISCX IDS 2012 dataset Shiravi et al. [2012] Hexadecimal Yu et al.”
Deep Learning Approach for Intelligent Intrusion Detection System (2019, methodology): “Various deep learning architectures and classical machine learning algorithms were evaluated for anomaly based ID on NSL-KDD dataset [74].”