HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection

By Wei Wang, Yiqiang Sheng, Jinlin Wang, Xuewen Zeng, Xiaozhou Ye, Yongzhong Huang, Ming Zhu. IEEE Access, 2018

571 citations recorded by the source corpus.

The development of an anomaly-based intrusion detection system (IDS) is a primary research direction in the field of intrusion detection. An IDS learns normal and anomalous behavior by analyzing network traffic and can detect unknown and new attacks. However, the performance of an IDS is highly dependent on feature design, and designing a feature set that can accurately characterize network traffic is still an ongoing research issue. Anomaly-based IDSs also have the problem of a high false alarm rate (FAR), which seriously restricts their practical applications. In this paper, we propose a novel IDS called the hierarchical spatial-temporal features-based intrusion detection system (HAST-IDS), which first learns the low-level spatial features of network traffic using deep convolutional neural networks (CNNs) and then learns high-level temporal features using long short-term memory networks. The entire process of feature learning is completed by the deep neural networks automatically; no feature engineering techniques are required. The automatically learned traffic features effectively reduce the FAR. The standard DARPA1998 and ISCX2012 data sets are used to evaluate the performance of the proposed system. The experimental results show that the HAST-IDS outperforms other published approaches in terms of accuracy, detection rate, and FAR, which successfully demonstrates its effectiveness in both feature learning and FAR reduction.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/c37480fd588ef464b741338738b7dbfddb045659

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey (2019, methodology): “Wang et al. [58] proposed a hierarchical deep learning detection method in which a session contains not only packet contents but also the packet time sequence.”
Variational LSTM Enhanced Anomaly Detection for Industrial Big Data (2021, background): “Generally, the signature-based and anomaly based detections are viewed as the two major problems investigated in intrusion detection systems [16].”
Deep Learning Approach Combining Sparse Autoencoder With SVM for Network Intrusion Detection (2018, methodology): “[26] proposed novel intrusion detection system called hierarchical spatial-temporal feature-based intrusion detection system (HAST-IDS); their system used the deep convolutional neural network for learning the low-level spatial features of network traffic, LSTM networks (long short-term memory netwo”
Deep Learning for Encrypted Traffic Classification: An Overview (2018, methodology): “or removed. For network classiﬁcation tasks, mixed models are reported to outperform pure LSTM or CNN models [12]. To capture both spatial and temporal features of a ﬂow, both CNN and RNN are used in [9], [12] for different applications. Aside from minor differences, both studies take the content of”
Deep Learning Approach for Intelligent Intrusion Detection System (2019, methodology): “The performance was shown on both KDDCup 99 and ISCX 2012 datasets [76].”