Deep Learning Approach for Intelligent Intrusion Detection System

By R. Vinayakumar, Mamoun Alazab, I. K. P. S. Senior Member, Prabaharan Poornachandran, Ameer Al-Nemrat, Sitalakshmi Venkatraman. IEEE Access, 2019

1,514 citations recorded by the source corpus.

Machine learning techniques are being widely used to develop an intrusion detection system (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely and automatic manner. However, many challenges arise since malicious attacks are continually changing and are occurring in very large volumes requiring a scalable solution. There are different malware datasets available publicly for further research by cyber security community. However, no existing study has shown the detailed analysis of the performance of various machine learning algorithms on various publicly available datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the years through static and dynamic approaches. This type of study facilitates to identify the best algorithm which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of DNNs and other classical machine learning classifiers are shown on various publicly available benchmark malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run till 1,000 epochs with the learning rate varying in the range [0.01–0.5]. The DNN model which performed well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers. Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert possible cyberattacks.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/d05d86db86a4ac0d95e6dcd951b42a9651939793

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Anomaly-based intrusion detection system for IoT networks through deep learning model (2022, neutral): “The standard metrics were employed to evaluate the model performance and examine their accuracy [24,25].”
Analysis of Dimensionality Reduction Techniques on Big Data (2020, background): “Several researchers proposed machine learning models for effective classification of intrusion detection datasets [34]–[36].”
Network intrusion detection system: A systematic study of machine learning and deep learning approaches (2020, background): “Vinayakumar et al 116 proposed a hybrid scalable DNN framework called as scale-hybrid-IDS-AlertNet, for intrusion identification at both host and network level.”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, methodology): “DNNs have been frequently used in NIDS with different parameters and structures proposed [43], [49], [52], [68].”